Why Secrets in JavaScript Bundles are Still Being Missed

Leaked API keys are no longer unusual, and breaches often follow, but sensitive tokens are still being exposed in front-end code, a problem that Intruder’s research team explored by scanning approximately 5 million applications. Their findings revealed more than 42,000 exposed tokens across 334 secret types, a level of exposure that existing tooling struggles to address, especially in single-page applications.

Traditional secrets-detection methods, which rely on known paths and regexes, miss many leaks that require spidering the application or authenticating, the study notes, leaving gaps that SPA-focused scanning must fill. Among the exposed secrets, code repository tokens and a Linear API key stood out, including an instance where a GitLab personal access token was embedded in a JavaScript file and allowed access to private repositories and CI/CD pipelines. Overall, the research argues for enhanced SPA secrets detection and a shift-left approach to catch secrets before production.