JS Bundle & Source Map Analysis -- Secret Extraction

When to Use

• ALWAYS after initial web enumeration
• When you find modern SPA (React, Angular, Vue)
• When target uses Firebase, Supabase, Auth0
• Higher yield than directory scanning on many targets

Why Analyze JS Bundles

Modern JavaScript bundles (Webpack, Vite, esbuild) often contain:

• Hardcoded API keys and tokens
• Internal API URLs
• Firebase, Auth0, Supabase configurations
• Environment variables (VITE_, REACT_APP_, NEXT_PUBLIC_*)
• Internal routes

Bundle Download and Analysis