Credentials in source code

One of the most common leaks in web apps is credentials (or other secrets) embedded in the code shipped to the client: JavaScript files, HTML comments, stylesheets, reachable config files (.env, config.js, settings.py), or exposed .git repositories. Everything the browser downloads is visible to anyone; "obfuscating" or "hiding" a secret in the frontend does not protect it.

The first reflex on any web app is to read the source:

curl -s http://<host>/ | grep -iE 'pass|user|token|key|secret|api'
# and review every linked .js
curl -s http://<host>/static/app.js
# crawl and comb through ALL the site's .js
katana -u http://<host>/ -jc | grep -iE '\.js' | while read u; do curl -s "$u"; done | grep -iE 'pass|token|api|secret'
# extract endpoints and secrets from a .js
python3 linkfinder.py -i http://<host>/static/app.js -o cli
python3 SecretFinder.py -i http://<host>/static/app.js -o cli
# web-exposed .git repository
git-dumper http://<host>/.git/ ./loot

The usual hot spots:

• JavaScript files. Login logic, API calls with keys, or "test"/"support" credentials someone left in for debugging (this box's case: a http://user:password@host/path URL inside a .js).
• HTML/JS comments. <!-- TODO: remove admin/admin before prod -->.
• Hidden endpoints and parameters referenced in the JS but not linked in the UI.
• A reachable .git/ directory, which lets you rebuild the code and its history (where a secret that was "removed" in a later commit often still lives).

Once found, the credentials are tried against every service (the login form, Basic Auth, SSH, internal panels): they're often reused, tying into credential reuse.

How to detect it. This vector's strength for the defender is that it is preventable by scanning: real detection is proactive, running secret scanners (gitleaks, trufflehog, git-secrets) over the repo and in a pre-commit / CI hook finds the credential before it ships. On the live server, access to files that should not be served (.env, .git/config, config.js) leaves GET /.git/... or GET /.env requests in the access log, a classic reconnaissance signature a WAF flags. And since the payoff is reusing the found credential, the follow-up signal is a valid login of that account (see credential reuse).

Defence. Never put secrets in code that reaches the client; manage them server-side (and in secret managers), not in the frontend. Block access to .git/ and config files, and review the repository history before publishing.