MapperPlus

03·Secret monitoring

Public JavaScript, read as it changes.

The scripts your sites serve are scraped and watched. A new file, or a hardcoded key, opens a finding with the URL and the line.

Get a DemoAll services

Works with

  • GitHub
  • GitLab
  • Bitbucket
  • Jira
Hardcoded key · line 212

We read your public scripts.

The JavaScript your sites serve is fetched and watched.A new file, or a hardcoded key, opens a finding with the URL and the line.

From a script URL to the line

Four stages run on their own.

The public bundle is fetched, every line is read, the key is marked where it sits, and the finding opens with the file and the line.

  1. 01

    Script fetched

    Autonomous

    The public URL is fetched. The file name and the path are kept.

  2. 02

    Lines read

    Autonomous

    A pass walks the file. A secret is marked on the line that holds it.

  3. 03

    Finding opens

    Autonomous

    Severity, the label, the file, and the line. It opens again when the file changes.

  4. 04

    Fixed in your code

    Autonomous

    The line is fixed in the repository and a merge request is opened for your engineers.

We watch for changes.

A new bundle, or a change in one you already watch, is read again.The finding opens the moment the file changes.

The line

The URL, the file, and the line that holds the key.

The finding points at the public script and the exact line. Your engineers do not search the bundle.

checkout.8f3c.js

Watching

pay.acme.com/assets/checkout.8f3c.jsupdated

8const endpoint = "/v1/charges"
9const stripeKey = "sk_live_acme_demo"
10async function charge(order) {
11 return fetch(endpoint, {
12 headers: {
13 "X-Signature": "whsec_demo_only"
14 }
15 })
16}

PROBLEMS0

  • Waiting for the next change…

What it covers

What it reads.

  • Public script URLs

    The bundles your sites already serve, fetched from the live URL.

  • Hardcoded keys

    API keys and tokens written into the script, marked on the line that holds them.

  • Signing secrets

    Webhook secrets and signature values shipped in client-side code.

  • File changes

    A new bundle, or a change in one you already watch, is read again.

We hand it to your team.

The finding opens in the queue that owns the site.The merge request is ready for review.

Delivered

The finding lands where the team works.

  • Jira

    A ticket, with severity and the asset.

  • Linear

    An issue in the engineering queue.

  • PagerDuty

    A page when the severity cannot wait.

What a finding carries

Every field the next team needs.

Severity, the label, the file, and the line travel with the ticket and the merge request.

FindingMP-1842
Severity
How serious the leaked value is.
Label
Hardcoded API key, signing secret, or another class of leak.
File
The public script URL.
Line
The line in that file.
All services

See secret monitoring on your own hosts.

Enter your domain. We map what is exposed and walk you through it in a live demo.

ISO 27001 certifiedNothing to installYour team merges every fix