Topic starter
19/08/2026 3:50 pm
TL;DR: Thousands of active secrets were found exposed in JavaScript bundles across 5 million apps, showing that front-end code can leak API keys, AWS access, and Slack access in ways common DAST tooling misses, according to Intruder research. The practical problem is not just detection, but governance over secrets that ship into client-side assets before they are ever executed.
Editorial analysis by NHI Mgmt Group, based on content published by Intruder: “The Vulnerabulletin Issue #3”.
Key questions
Q: What fails when API keys are shipped in JavaScript bundles?
A: The failure is that a build-time secret becomes a publicly retrievable client-side artefact.
Q: Why do exposed developer credentials and secrets create such a high-risk path for attackers?
A: Exposed credentials matter because they bypass many defensive layers and give attackers immediate, legitimate-looking access.
Q: What signs show that secret scanning is missing front-end exposure?
A: A common sign is when repository scans look clean but production bundles still contain active credentials.
Practitioner guidance
- Scan release bundles, not just source code Add checks to the build and release pipeline that inspect final JavaScript artefacts for embedded API keys, tokens and other secrets before deployment.
- Classify every exposed credential by blast radius Map each leaked key to the cloud, SaaS or internal service it can reach, then revoke any credential whose scope cannot be tightly justified.
- Move secrets out of client-delivered code Replace hard-coded front-end secrets with server-side retrieval, delegated access or short-lived tokens that are not embedded in browser assets.
Bottom line: JavaScript bundle secret leakage turns front-end assets into a credential exposure channel that many common scanning approaches do not fully cover.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:26 pm
Front-end bundle secret leakage is a machine-identity governance failure. Once API keys are compiled into JavaScript, they stop behaving like controlled credentials and start behaving like exposed artefacts. That shifts the problem from runtime access control to pre-deployment secret governance, which many application teams still treat as a code-quality issue rather than an identity risk. Practitioners should govern bundle output as part of the credential lifecycle.
A few things that frame the scale:
- DeepSeek alone generated 113,000 new exposed API keys in 2025, illustrating how new AI providers create credential exposure before security guardrails catch up, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should teams prioritise bundle scanning or secret rotation first?
A: Teams should do both, but bundle scanning comes first when the leak path is still active. Rotation limits damage after exposure, while bundle scanning prevents new credentials from shipping into browser-delivered code. If the release pipeline keeps reintroducing secrets, rotation alone becomes a recurring containment exercise rather than a durable fix.
👉 Read our full editorial: JavaScript bundle secrets exposure is widening front-end attack surfaces