Client-Side JavaScript Secrets
| ID | Check | Passes when | Weight | Runs |
|---|
| 7.11.01 | Scan client-side JavaScript for exposed API keys and tokens | None found | Critical | Deterministic |
| 7.11.02 | Check frontend code for auth tokens (JWT secrets, OAuth client secrets) | None found | Critical | Deterministic |
| 7.11.03 | Detect hardcoded passwords in JavaScript source | None found | Critical | Deterministic |
| 7.11.04 | Scan for third-party API keys (SendGrid, Twilio, Mailchimp, Slack, etc.) | None found | Heavy | Deterministic |
| 7.11.05 | Check for exposed webhook URLs in client-side code | None found | Heavy | Deterministic |
Database Credentials
| ID | Check | Passes when | Weight | Runs |
|---|
| 7.11.06 | Detect database connection strings with passwords in public files | None found | Critical | Deterministic |
| 7.11.07 | Check for MongoDB or Redis connection URIs in website source | None found | Critical | Deterministic |
| 7.11.08 | Detect database password assignments in environment variable patterns | None found | Critical | Deterministic |
| 7.11.09 | Verify database credentials not present in HTML comments or source | None found | Heavy | Deterministic |
| 7.11.10 | Scan for SQL connection strings in client-visible code | None found | Heavy | Deterministic |
Private Keys
| ID | Check | Passes when | Weight | Runs |
|---|
| 7.11.11 | Detect RSA private keys in website source or scripts | None found | Critical | Deterministic |
| 7.11.12 | Detect EC (Elliptic Curve) private keys in website source | None found | Critical | Deterministic |
| 7.11.13 | Detect PGP private key blocks in publicly accessible content | None found | Critical | Deterministic |
Source Map Exposure
| ID | Check | Passes when | Weight | Runs |
|---|
| 7.11.14 | Check for sourceMappingURL references that expose original source code | None found | Heavy | Deterministic |
| 7.11.15 | Verify source maps are not served to public users | Not served | Medium | Deterministic |
| 7.11.16 | Confirm build process strips source maps for production | Stripped | Medium | Deterministic |
Sensitive File Exposure
| ID | Check | Passes when | Weight | Runs |
|---|
| 7.11.17 | Probe /.env and /.env.* files for public accessibility | Not accessible (HTTP 403 or 404) | Critical | Deterministic |
| 7.11.18 | Probe /.git/config and /.git/HEAD for public accessibility | Not accessible | Critical | Deterministic |
| 7.11.19 | Probe /wp-config.php.bak and /wp-config.php~ for public accessibility | Not accessible | Heavy | Deterministic |
| 7.11.20 | Probe server config files (/config.js, /config.json, /application.yml, /.htpasswd, /phpinfo.php) | Not accessible | Heavy | Deterministic |
| 7.11.21 | Probe cloud credential files (/.aws/credentials, /.docker/config.json) | Not accessible | Critical | Deterministic |
Payment Processor Keys
| ID | Check | Passes when | Weight | Runs |
|---|
| 7.11.22 | Detect Stripe secret or restricted keys in client-side code | None found (only publishable keys pk_live_ are acceptable) | Critical | Deterministic |
| 7.11.23 | Detect PayPal client secrets or access tokens in frontend code | None found | Critical | Deterministic |
| 7.11.24 | Detect Square access tokens in frontend code | None found | Critical | Deterministic |
Cloud Provider Keys
| ID | Check | Passes when | Weight | Runs |
|---|
| 7.11.25 | Detect AWS Access Key IDs and Secret Access Keys in website source | None found | Critical | Deterministic |
| 7.11.26 | Detect GCP API keys or service account credentials in website source | None found | Critical | Deterministic |
| 7.11.27 | Detect Azure connection strings or Shared Access Keys in website source | None found | Critical | Deterministic |
Overall Secret Hygiene
| ID | Check | Passes when | Weight | Runs |
|---|
| 7.11.28 | Verify no critical-severity secrets found across all scan surfaces | Zero critical findings | Critical | Deterministic |
| 7.11.29 | Verify no high-severity secrets found across all scan surfaces | Zero high findings | Heavy | Deterministic |
| 7.11.30 | Compute overall secret hygiene score (secrets + exposed files + source maps) | Clean | Heavy | Deterministic |
← 7.10 Advanced Security Trust Signals
Run these checks on your site
A Deep Audit scores every check here that applies to your page, then an AI pass of up to 150 checks. Included on Pro and Ultra, or $9 for one audit.
See plans
Machine-readable: catalog totals and the
full catalog as JSON (IDs, section, weight, status).