skills.rest
bpnrockstar
bpnrockstarCOMMUNITY
Explore all skills by this author →
GitHub

hunt-source-leak

Recover hardcoded secrets from JavaScript source maps, Swagger endpoints, and exposed Git repositories.

Updated Jul 1, 2026
Search Tags:#reconnaissance#websecurity#sourceleak#secretdiscovery#gitexposure#swaggerscan#buildartifact
One-click install
npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-source-leak-bpnrockstar
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-source-leak
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/hunt-source-leak
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-source-leak-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This skill automates the detection and recovery of hardcoded secrets like API keys, passwords, and internal endpoints from JavaScript source maps, Swagger/OpenAPI specifications, Git repositories, and build artifacts, preventing accidental exposure and data breaches.

Core Features & Use Cases

  • Source Map Analysis: Reconstructs TypeScript/ES6 source code from .js.map files to find hidden APIs and secrets.
  • Swagger/OpenAPI Discovery: Extracts complete API specifications revealing internal endpoints and auth schemes.
  • Git Exposure Check: Detects and reconstructs exposed Git repositories to recover past secrets.
  • Use Case: During a penetration test, use this skill early to identify high-value secrets that can unlock further access or provide direct evidence of insecure coding practices.

Quick Start

Run the hunt-source-leak skill targeting the base URL to automatically check for source maps, swagger specs, exposed git, and forgotten files.

Frequently Asked Questions about hunt-source-leak

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find hardcoded secrets leaked in JavaScript source maps?▼

Recovering hardcoded secrets from JavaScript source maps involves reconstructing TypeScript and ES6 source code from `.js.map` files. This static analysis exposes hidden API endpoints and accidentally leaked credentials within the recovered application logic.

What is the best way to extract internal endpoints from a Swagger OpenAPI specification?▼

Extracting internal endpoints from Swagger or OpenAPI specifications involves pulling complete API definitions to reveal hidden routes and authentication schemes. This process identifies insecure coding practices and misconfigurations during web application reconnaissance.

How do I check for exposed Git repositories and recover past secrets?▼

Checking for exposed Git repositories involves detecting and reconstructing repository structures from misconfigured web servers. This allows security assessments to recover past hardcoded secrets like API keys and passwords by analyzing historical commit artifacts.

Do I need Python and curl to scan build artifacts for leaked API keys?▼

Yes, scanning build artifacts for leaked API keys requires Python 3 and curl. Python handles associated libraries for YAML and JSON processing during static analysis, while curl manages the network requests needed to fetch exposed files.

Can I use source map analysis to find misconfigurations during a penetration test?▼

Yes, you can use source map analysis during penetration tests to find misconfigurations and insecure coding practices. Reconstructing source code from JavaScript build artifacts provides direct evidence of accidental secret exposure and data breach risks.

Related Skills

Explore More Software Engineering Skills→
RheasilviaRheasilvia

here.now

Publish static web content and manage private cloud file storage via API.

Community
Intermediate
AIDotNetAIDotNet
84

security-scanner

Unavailable for this prompt. Please try again or contact administrator. Alternatively, here's a suggestion:

Official
Intermediate
langbyyilangbyyi
96

insecure-source-code-management

Detect exposed .git, .svn, .hg metadata and backup files on web applications.

Community
Intermediate
riandeoliveirariandeoliveira

implementing-secret-scanning-with-gitleaks

Scan Git repositories with Gitleaks to detect and prevent hardcoded credentials.

Community
Advanced