KeyScanner - A Node.js CLI that scans website frontend JavaScri

项目说明

keyscanner

<img width="1295" height="1497" alt="image" src=" />

A Node.js security research CLI that scans a website's frontend Ja (linked and inline) — and, optionally, public GitHub source — for accidentally committed API keys and secrets. It detects and reports exposed credentials so they can be rotated and remediated; it ne with, , or otherwise uses any key it finds. Think of it as a focused, browser facing companion to tools like gitleaks or TruffleHog.

Installation

Requires Node.js 18+.

After the global install, the keyscanner command is a on your PATH. You can also run it without a global install via node src/index.js <command>.

Usage

On startup keyscanner prints a cyan 3D ASCII-art banner to stderr (so it ne with --json output). On terminals narrower than the art it shows a compact one-line . Disable it any time with the global --no-banner flag; it's also auto-hidden in --json mode.

Running keyscanner with no command prints the banner followed by the help text. You can also print the banner on demand with keyscanner banner.

scan — scan a single site

| Option | Description | Default |
| --- | --- | --- |
| -o, --output <file> | Save a full JSON report | — |
| --csv <file> | Save a CS | — |
| --json | Print the JSON report to stdout (suppresses the formatted output) | off |
| -c, --concurrency <n> | Parallel JS file fetches | 3 |
| -t, --timeout <ms> | Per-request timeout | 10000 |
| --no-inline | Skip inline <script> blocks | inline on |
| - | Log each file scanned | off |

Exits with code 1 if any critical finding is detected (useful in CI).

#### Piping JSON

With --json, only the JSON report goes to stdout — the spinner,
logs, and "report written" messages all go to stderr — so the output stays
valid JSON for piping into tools like jq:

The same --json flag is a on the github command.

github — search public GitHub code

| Option | Description | Default |
| --- | --- | --- |
| --token <token> | GitHub personal access token (recommended; or set GITHUB_TOKEN) | — |
| --all | Scan with every built-in pattern instead of a single query | off |
| --self | Audit all repos owned by your authenticated account (public + private) | off |
| --max <n> | Max files per pattern (--all), or max repos to scan (--self) | 10 |
| -o, --output <file> | Save a JSON report | — |
| --json | Print the JSON report to stdout (suppresses formatted output) | off |
| - | Log each file scanned | off |

GitHub Code Search requires authentication for most queries. If you hit a rate limit, the tool prints the reset time. Use this command only to find your own leaked secrets or secrets you intend to responsibly disclose to the affected owner.

#### --all — scan with every built-in pattern

Instead of supplying a query, pass --all to scan GitHub the same way the website scanner works — against the full pattern set:

How it works: GitHub's Code Search API always requires a query string, so --all takes the distincti seed defined on each pattern (e.g. AIzaSy, sk_live_, ghp_, sk-ant-) and runs one search per seed. Every file returned by any search is then fetched and checked against all patterns (not just the one that surfaced it), and findings for the same file are merged and de-duplicated.

Notes:

#### --self — audit your own repos

Scan every repository you own for leaked secrets — a defensi. Unlike Code Search, this reads your repos directly, so it covers private repos too and scans the *whole* repo, not just search hits.

How it works: it identifies you via your token (GET /user), lists your owned repos (most-recently-updated first), and for each one walks the default-branch file tree and scans every text/code file (fetched through the authenticated blobs API) against all patterns. Findings are reported per file with a direct link to the file on GitHub.

Notes:

bulk — scan many sites

Where sites.txt has one URL per line (blank lines and # comments ignored).

| Option | Description | Default |
| --- | --- | --- |
| -o, --output <dir> | Directory for per-site JSON reports | — |
| --csv <file> | Aggregate CSV of all findings | — |
| -c, --concurrency <n> | Sites scanned in parallel | 2 |
| -t, --timeout <ms> | Per-request timeout | 10000 |
| - | Log each file scanned | off |

Prints a summary table (site | findings | crit | high | med) at the end and exits 1 if any critical finding is detected.

Detected key types

| Key type | Se |
| --- | --- |
| Google API Key (AIza…) | critical |
| AWS Access Key ID (AKIA…) | critical |
| AWS Secret Access Key | critical |
| Stripe Li Key (sk_live_…) | critical |
| Stripe Li Key (pk_live_…) | high |
| GitHub Personal Access Token (ghp_…) | critical |
| GitHub OAuth Token (gho_…) | critical |
| Slack Token (xoxb-, xoxa-, …) | high |
| Firebase Project URL (*.firebaseio.com) | medium |
| Firebase API Config Block | high |
| Twilio Account SID (AC…) | critical |
| Twilio Auth Token | critical |
| SendGrid API Key (SG.…) | critical |
| Mailgun API Key (key-…) | high |
| JWT Token (eyJ…) | medium |
| OpenAI API Key (sk-…) | critical |
| Anthropic API Key (sk-ant-…) | critical |
| HuggingFace Token (hf_…) | high |
| Mapbox Token (pk.eyJ1…) | high |
| Bearer Token in JS string | medium |
| Generic Hardcoded Secret (apiKey/secret/token/password = 16+ chars) | medium |

Patterns are heuristic: false positi, and the absence of a finding is not proof a site is clean. Always by hand.

Responsible disclosure

> Always report findings, ne them.

If you discover an exposed secret that is not yours:

1. Do not use, test, or the key against any li.
2. Notify the owner pri (security contact, security.txt, or a coordinated-disclosure platform).
3. Give them reasonable time to rotate the credential before any public mention.

If the key is yours: rotate it immediately, then audit logs for misuse.

Legal disclaimer

This tool is provided for authorized security testing, defensi, and educational research only. You are responsible for ensuring you ha to scan any target. Scanning systems you do not own or are not explicitly authorized to test may the U.S. Computer Fraud and Abuse Act, the UK Computer Misuse Act, and equi laws in other jurisdictions. The authors accept no liability for misuse. By using keyscanner you agree to use it lawfully and ethically.

License

MIT

项目信息

开发语言：JavaScript

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A Node.js CLI that scans website frontend JavaScript and public GitHub, source for accidentally exposed API keys — detect-and-report only, built for responsible disclosure and defensive security.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。