# Hunt Source Leak

Hunt source code and build artifact leakage, JavaScript source maps (.js.map)...

- Repository: https://github.com/Zyrexnn/Cybermes (987 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add Zyrexnn/Cybermes --skill hunt-source-leak -g -a claude-code -y`
Codex: `npx skills add Zyrexnn/Cybermes --skill hunt-source-leak -g -a codex -y`
Cursor: `npx skills add Zyrexnn/Cybermes --skill hunt-source-leak -g -a cursor -y`
Gemini CLI: `npx skills add Zyrexnn/Cybermes --skill hunt-source-leak -g -a gemini-cli -y`

## Description

Hunt source code and build artifact leakage, JavaScript source maps (.js.map) reconstructing TypeScript/ES6 source, Swagger/OpenAPI JSON endpoint discovery, .env/.git exposure, webpack chunks with hardcoded secrets, robots.txt/security.txt recon, build-info files, asset-manifest.json API route discovery, .DS_Store file listing. Use at the START of every recon session, these findings often unlock the entire attack surface.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# HUNT-SOURCE-LEAK, Source Code & Build Artifact Leakage

## Crown Jewel Targets

Source map exposing TypeScript source = see all API routes, auth logic, secrets. Swagger/OpenAPI JSON = complete API surface map.

**Highest-value findings:**
- **`.js.map` source maps**, reconstruct full TypeScript/ES6 source code → find hardcoded API keys, internal endpoints, auth logic bypasses
- **`swagger.json` / `openapi.json`**, complete REST API specification with all endpoints, parameters, auth schemes, and internal route names
- **`.env` / `.env.production`**, APP_KEY, DB_PASSWORD, API_KEY, SECRET_KEY in plaintext
- **`.git/` exposure**, `git clone` the entire source history → all past hardcoded secrets
- **`asset-manifest.json` / `_next/static/`**, all JS bundle paths → systematic source map discovery
- **`build-info` / `info.json`**, git commit hash, build timestamp, dependency versions → CVE targeting

---

## Phase 1, Quick Wins (Run First)

```bash
# These 10 requests take <30 seconds and often yield Critical findings
for PATH in \
  "/.env" \
  "/.env.production" \
  "/.env.local" \
  "/.git/HEAD" \
  "/swagger.json" \
  "/api/swagger.json" \
  "/v1/swagger.json" \
  "/openapi.json" \
  "/api/openapi.json" \
  "/api-docs"; do
  STATUS=$(curl -s -o /tmp/sl_test -w "%{http_code}" "https://$TARGET$PATH")
  if [ "$STATUS" = "200" ]; then
    echo "[+] HIT: https://$TARGET$PATH"
    head -5 /tmp/sl_test
    echo "---"
  fi
done
```

---

## Phase 2, Source Map Discovery

The rest: https://github.com/Zyrexnn/Cybermes/blob/HEAD/knowledge/Claude-BugHunter/skills/hunt-source-leak/SKILL.md