--- title: Why Secrets in JavaScript Bundles are Still Being Missed description: Research scanning 5 million applications uncovered over 42,000 exposed secrets in JavaScript bundles, revealing critical gaps in traditional security tools.... canonical: https://daily.dev/posts/why-secrets-in-javascript-bundles-are-still-being-missed-ls1x97mw9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Why Secrets in JavaScript Bundles are Still Being Missed | daily.dev og:description: Research scanning 5 million applications uncovered over 42,000 exposed secrets in JavaScript bundles, revealing critical gaps in traditional security tools.... og:url: https://daily.dev/posts/why-secrets-in-javascript-bundles-are-still-being-missed-ls1x97mw9 og:image: https://api.daily.dev/og/posts/lS1x97MW9.png og:image:alt: Why Secrets in JavaScript Bundles are Still Being Missed og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Why Secrets in JavaScript Bundles are Still Being Missed **[The Hacker News](https://daily.dev/sources/thn)** · 6 min read · 0 upvotes · 0 comments ## Summary Research scanning 5 million applications uncovered over 42,000 exposed secrets in JavaScript bundles, revealing critical gaps in traditional security tools. SAST, DAST, and infrastructure scanners often miss secrets embedded in front-end JavaScript files because they don't spider single-page applications or scan bundled assets. The exposed tokens included 688 code repository credentials (GitHub, GitLab), project management API keys, and webhooks for platforms like Slack and Teams. Many tokens were still active and granted full access to private repositories, CI/CD pipelines, and sensitive organizational data. The findings demonstrate that shift-left security controls alone are insufficient, as secrets introduced during build and deployment can bypass early-stage safeguards and reach production in front-end code. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [The Forgotten Security Goldmine Hiding in Chrome DevTools](https://daily.dev/posts/the-forgotten-security-goldmine-hiding-in-chrome-devtools-qcb9xx8gh) · JS Dev Space · 0 upvotes · 1 comments - [Security boffins harvest bumper crop of API keys from web](https://daily.dev/posts/security-boffins-harvest-bumper-crop-of-api-keys-from-web-56ku6ambh) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript) [View this post on daily.dev](https://daily.dev/posts/why-secrets-in-javascript-bundles-are-still-being-missed-ls1x97mw9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Why Secrets in JavaScript Bundles are Still Being Missed","url":"https://daily.dev/posts/why-secrets-in-javascript-bundles-are-still-being-missed-ls1x97mw9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/why-secrets-in-javascript-bundles-are-still-being-missed-ls1x97mw9"},"datePublished":"2026-01-20T11:46:54.479Z","dateModified":"2026-01-20T11:47:19.230Z","description":"Research scanning 5 million applications uncovered over 42,000 exposed secrets in JavaScript bundles, revealing critical gaps in traditional security tools....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6599821f72bd26906cb238bdf8ab22f2?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6599821f72bd26906cb238bdf8ab22f2?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"The Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/thn","url":"https://daily.dev/sources/thn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/why-secrets-in-javascript-bundles-are-still-being-missed-ls1x97mw9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,javascript","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Hacker News","item":"https://daily.dev/sources/thn"},{"@type":"ListItem","position":3,"name":"Why Secrets in JavaScript Bundles are Still Being Missed"}]} ```