I scanned 37 sites from Hacker News for exposed secrets. Found real leaks.
Hey IH,
I've been building a passive security scanner for the past few weeks. It checks your deployed site for secrets accidentally left in your JavaScript bundles.
Most security tools scan your GitHub repos. Mine scans what's actually live. What attackers see when they view source.
I tested it on 37 indie sites from Hacker News over the last two days.
Results:
- 1 site had 6 actual secrets in their production code (1 cloud credential, 5 API keys)
The site with leaked secrets launched recently. The founder probably has no idea.
What the scanner looks for:
- AWS keys, Stripe keys, Firebase, OpenAI, database URLs, 30+ patterns in your compiled JS
To be clear: not every detection is a real secret. Firebase client configs are public by design. The tool flags patterns worth checking.
If you want to see it work first, scan wirier.com. I built it as a demo target with fake secrets planted in the code.
Free to use. No signups. One click.
Would love feedback from anyone who tries it. If you find something on your own site... you're welcome.
