HUNT-SOURCE-LEAK, Source Code & Build Artifact Leakage

Crown Jewel Targets

Source map exposing TypeScript source = see all API routes, auth logic, secrets. Swagger/OpenAPI JSON = complete API surface map.

Highest-value findings:

• .js.map source maps, reconstruct full TypeScript/ES6 source code → find hardcoded API keys, internal endpoints, auth logic bypasses
• swagger.json / openapi.json, complete REST API specification with all endpoints, parameters, auth schemes, and internal route names
• .env / .env.production, APP_KEY, DB_PASSWORD, API_KEY, SECRET_KEY in plaintext
• .git/ exposure, git clone the entire source history → all past hardcoded secrets
• asset-manifest.json / _next/static/, all JS bundle paths → systematic source map discovery
• build-info / info.json, git commit hash, build timestamp, dependency versions → CVE targeting

---

Phase 1, Quick Wins (Run First)

# These 10 requests take <30 seconds and often yield Critical findings
for PATH in \
  "/.env" \
  "/.env.production" \
  "/.env.local" \
  "/.git/HEAD" \
  "/swagger.json" \
  "/api/swagger.json" \
  "/v1/swagger.json" \
  "/openapi.json" \
  "/api/openapi.json" \
  "/api-docs"; do
  STATUS=$(curl -s -o /tmp/sl_test -w "%{http_code}" "https://$TARGET$PATH")
  if [ "$STATUS" = "200" ]; then
    echo "[+] HIT: https://$TARGET$PATH"
    head -5 /tmp/sl_test
    echo "---"
  fi
done

---

Phase 2, Source Map Discovery