JS Secret Scanner
Scan JavaScript files using a multi-stage pipeline — provider detection, entropy analysis, context analysis, and risk scoring.
* Localhost and internal IPs are blocked (SSRF protection).
How The Pipeline Works
Provider Detection
Strict regex patterns for known providers (Firebase, OpenAI, Stripe, etc.) are applied first for highest accuracy.
Generic Detection
Patterns like api_key, client_secret, and access_token capture secrets even from custom or unknown providers.
Entropy Analysis
Shannon Entropy measures the randomness of a matched string. Entropy > 4.5 signals a real cryptographic key, filtering false positives.
Risk Score & Display
Context is captured, findings are deduplicated, and each result is assigned a Critical/High/Medium/Low risk score before being masked in the UI.