client-secret-exposure-audit
Client-Side Secret & Sensitive-File Exposure Audit
Overview
Modern web apps ship a lot of code and config to the browser. When credentials
leak into that client-visible surface — hardcoded in JavaScript, tucked into HTML
meta/data-* attributes or comments, or served as raw source/config/deploy
files that were never meant to be public — anyone can read them with curl and a
browser. This skill is a defensive, read-only workflow for finding that class
of exposure on a web app you are authorized to assess.
It maps to OWASP A02:2021 Cryptographic Failures (sensitive data exposure), A05:2021 Security Misconfiguration, and CWE-798 (hardcoded credentials), CWE-200 (sensitive information exposure), CWE-540 (source code in a production build). It only fetches resources the server already hands to any anonymous visitor — it does not exploit, brute-force, or mutate anything.