Crawl a target URL, harvest its JavaScript bundles, inline scripts and source maps, and scan all of it for ~40 curated secret patterns (AWS, GCP, Stripe, Razorpay, Slack, GitHub, GitLab, SendGrid, Mailgun, Twilio, Discord, Telegram, npm, PyPI, DigitalOcean, Cloudflare, Linear, Square, PEM private keys, JWTs, internal URLs and more) plus a Shannon-entropy heuristic for unclassified high-entropy strings. Findings grouped by severity, masked by default, with snippet context, source-map awareness, JSON / CSV / Markdown export and Burp handoff. Pro tier server-side; hard caps keep scans under 60s and 12MB.
JS Secrets Scanner is part of the XowiaScan Web Security Audit toolset. It runs server-side: submit a target and the suite performs the lookup/scan, returning structured results saved to your private scan history.
Free tier: included via a 6-hour token allowance and rate limits. Paid tiers: unmetered. Also available through the scoped API.