Scanning for Secrets: How Automated Tools Find Hardcoded Credentials in the Wild

Modern web applications increasingly offload logic to the frontend. But with this architectural shift comes a dangerous side effect: developers accidentally ship secrets in production JavaScript.

From exposed Firebase keys to full-access JWTs, these secrets are harvested by automated scanners like Axe:ploit—the same kind of tools used by attackers mapping your asset surface.

Why Secrets Appear in Frontend Code

Secrets don't end up in JavaScript by chance. They're leaked due to bad assumptions, flawed CI pipelines, or unguarded build steps. Common causes include:

Using client-side SDKs that require API keys (e.g., Firebase, Stripe)
Shipping .env variables into frontend bundles via webpack/Vite
Leaving test tokens or backdoor credentials in dev branches merged to main
Misunderstanding the trust boundary—putting secrets into window scope

If a secret exists in a JS bundle, it’s public. Obfuscation does nothing.

How Axe:ploit and Similar Tools Detect Secrets at Scale

Secrets scanning in public-facing JS is now a standard offensive recon tactic. Tools like Axe:ploit, TruffleHog, and Gitleaks don’t rely on chance—they apply multi-layered heuristics to catch both obvious and obfuscated leaks.

1. Static JS Parsing

Scanners parse JavaScript ASTs (Abstract Syntax Trees) to extract variable definitions, literal strings, function parameters, and embedded objects—then recursively trace references.

2. Pattern-Based Signature Matching

Over 200+ regex patterns are matched against these literals, targeting known key formats:

Google API Keys (AIza[0-9A-Za-z-_]{35})
Stripe Live Keys (sk_live_[0-9a-zA-Z]{24})
GitHub Tokens (ghp_[0-9a-zA-Z]{36})
Slack Webhooks, Twilio SIDs, AWS Keys, etc.

3. Entropy Analysis

Secrets tend to be high-entropy strings—scanners use Shannon entropy and byte distribution models to flag suspicious blobs even when no known format matches.

4. Contextual Awareness

Tools apply NLP-style heuristics to label variable names like authToken, secret, or jwt as semantic indicators, increasing match confidence when paired with risky usage patterns (e.g., sent in Authorization headers).

Real-World Leak Examples

Firebase API Key in a Production Bundle

const firebaseConfig = {
  apiKey: "AIzaSyD8XKLMNOPQRSTUVWXYZ1234567890",
  authDomain: "myapp.firebaseapp.com",
  projectId: "myapp-id",
};

Matched against known Firebase pattern
Located in top-level object literal
Entropy score > 3.9 → High confidence leak

JWT Token Left in Client Code

const token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...";
fetch("/api/profile", {
  headers: { Authorization: `Bearer ${token}` },
});

Pattern matches base64-encoded JWT structure
Context: Used inside an Authorization header
Potential for real access if token isn't expired

Inside Axe:ploit’s Detection Flow

flowchart TD A[Public JavaScript] --> B[AST Parsing] B --> C[Extract Literals, Variables, Keys] C --> D[Regex Match] D --> E[Known Key Formats] D --> F[JWT / OAuth Patterns] D --> G[Base64 Encodings] E --> H[Entropy Check] F --> H G --> H H --> I{Entropy Threshold Met?} I -->|Yes| J[Flag as Probable Secret] I -->|No| K[Apply Contextual Filters] K --> L{Used in Sensitive Context?} L -->|Yes| J L -->|No| M[Discard or Lower Confidence] J --> N[Generate Alert with Severity] M --> O[Continue Scanning] style J stroke:#ff4d4f style N stroke:#ff4d4f

Defending Against Secret Leaks

What You Should Be Doing

Never hardcode secrets in frontend JavaScript—assume the bundle is public
Store sensitive values in backend environments only
Use proxy APIs to keep frontend client credentials minimal or scoped
Strip all .env or debug data from your builds (e.g., dotenv, webpack.DefinePlugin)
Add pre-deploy scans with TruffleHog, Gitleaks, or a custom Axe:ploit pipeline

# Sample pre-deploy Git hook
gitleaks detect --source=. --report-format json --exit-code 1

Consider Client-Side Public Keys vs Private Secrets

Not all “secrets” are dangerous. Some keys (like Google Maps API keys) are scoped to public usage, IP locked, or domain-bound. Still, treat every leak as a policy violation and verify its blast radius.

In Summary

Secrets scanning is no longer niche—it’s table stakes for offensive security and mature SDLC pipelines. The tools are automated, the scans are fast, and the stakes are high.

The question is not if your JS contains secrets—it’s whether you or someone else finds them first.

Scan aggressively. Monitor diffs. And keep your credentials server-side—where they belong.