Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

65 deep-dives · 27 topics

Follow via RSS

Posts tagged #secrets

1 post

All topics Clear tag filter

Files, objects & APIs accessKeyId:"AKIAIOSFODNN7EXAMPLE"

Information Disclosure6 min read

Exposed Secrets in JavaScript: Bundles and Source Maps Publish Your Keys

Anything compiled into a JavaScript bundle or carried in a source map is readable by every visitor. Here is how API keys and private keys end up there, how to tell a public identifier from a real secret, and why rotation, not deletion, closes the exposure.