Supaleak scans live websites for exposed API keys, tokens, JWTs, Supabase keys, and other sensitive data before attackers do. It automatically scans JavaScript files using Kingfisher rules to detect and validate secrets.

Supaleak is a security monitoring tool designed to scan live production websites for exposed sensitive credentials such as API keys, tokens, JWTs, Supabase keys, and other secrets that may be inadvertently leaked within JavaScript files. It serves development teams, visual coders, and users of low-code tools who deploy code rapidly, aiming to protect their infrastructure by detecting these leaks before malicious actors can exploit them. The primary purpose is to provide continuous, automated oversight of web assets to prevent security breaches that stem from accidental credential exposure during fast-paced development cycles, thereby safeguarding critical services and data.

In the modern development landscape, teams are shipping code faster than ever due to tools like vibe coding, visual coders, and low-code platforms, enabling deployment in hours rather than weeks. This acceleration fosters innovation but significantly increases the risk of exposing sensitive credentials in JavaScript files that are publicly accessible. The common mantra of 'ship fast, break things, fix later' overlooks the immediate danger posed by leaked secrets, which attackers can discover and misuse long before the next sprint or fix cycle. This creates a critical security gap where production sites remain vulnerable to credential theft, leading to potential data breaches, unauthorized access, and compromised infrastructure.

One major feature group is the automatic scanning of JavaScript files using Kingfisher rules to detect API keys, tokens, and secrets from a wide range of services. The tool systematically crawls live websites, identifies JavaScript files, and applies these detection rules to uncover potential credentials embedded in the code. This process works by parsing the JavaScript content for patterns that match known secret formats, ensuring comprehensive coverage without manual intervention. It matters because it addresses the core problem of accidental leaks by providing an automated, reliable method to identify exposures that might otherwise go unnoticed until exploited.

Another key feature is validation, which reduces false positives by checking if detected secrets are actually active and exposed. After scanning identifies potential credentials, Supaleak's validation feature tests each one to verify its authenticity and current status, distinguishing between real vulnerabilities and false alarms like test keys, example values, or revoked tokens. This works by attempting to authenticate or query the associated service with the secret to confirm its validity. It is crucial because it allows teams to focus their efforts on genuine security issues, saving time and resources while ensuring that only real threats are addressed, thereby enhancing overall security posture.

Supaleak

Key Features

Use Cases

Who is this for?

Comments