JS Secrets

Repo: https://github.com/diegoespindola/jssecrets-caido-plugin

Caido plugin that scans every JavaScript file passing through the proxy for sensitive information: hardcoded API keys, tokens and credentials.

Note: not to be confused with jsSecrets (PyPI), an earlier, unrelated Python CLI tool.

When it finds something, it highlights the request in HTTP History (via Caido's native Findings API) and adds it to its own sidebar section called JS Secrets.

How it works

packages/
├── backend/src/
│   ├── patterns.ts   # List of regex patterns (API keys, tokens, credentials)
│   ├── scanner.ts     # Filters JS responses and runs the patterns over the body
│   ├── db.ts           # SQLite persistence (`secrets` table)
│   └── index.ts        # onInterceptResponse, Findings, RPC (getSecrets/clearAllSecrets/rescanHistory)
└── frontend/src/
    ├── index.ts                          # Registers the page and sidebar item
    ├── views/App.vue                     # Toolbar (Rescan/Clear) + table
    └── components/SecretsTable/          # Table with severity, masked value and copy

1. Every response intercepted by the proxy goes through scanResponse, which first discards anything that isn't JavaScript (Content-Type or .js/.mjs/.cjs extension) before running the regexes, to avoid wasting CPU on irrelevant traffic.
2. Every new match (deduplicated by host + path + pattern + value) is saved to SQLite and generates a Finding, which is what highlights the request in the HTTP History list.
3. The frontend updates live via backend → frontend events (secret-found), no page refresh needed.
4. Rescan History re-scans all the traffic Caido already had captured (useful if you install the plugin after already having traffic recorded).

Detected patterns

Pattern	Severity
AWS Access Key ID	Critical
Stripe Secret Key	Critical
GitHub Token / Fine-Grained Token	Critical
Slack Token	Critical
Private Key (PEM)	Critical
Google API Key	High
Credentials in URL (user:pass@host)	High
Mailgun API Key	High
Twilio API Key	High
Square Access Token	High
Stripe Publishable Key	Medium
JSON Web Token (JWT)	Medium
Bearer Token	Medium
Generic API Key / Secret / Token (key = "..." assignments)	Medium
Generic Password	Low

The full list with the regexes lives in packages/backend/src/patterns.ts — it's the only file you need to touch to add or tweak a pattern.

Security and limits

• Values are masked in the table by default (with a reveal/copy button) so the screen can be shared without exposing secrets.
• Scanning is capped at 2 MB per response to bound the regex cost on large JS bundles.
• There's no in-UI pattern editor and no "Rescan this request" context-menu command in this version — left out of v1 because the SDK docs don't confirm an API for the latter without guessing at it.

Development

Requires Node.js 18+ and pnpm.

pnpm install
pnpm typecheck   # tsc / vue-tsc across both packages
pnpm lint        # eslint --fix
pnpm build       # generates dist/plugin_package.zip
pnpm watch       # hot-reload with Caido's Devtools plugin

Manual install: Caido → Settings → Plugins → Install → select dist/plugin_package.zip.

Stack

• pnpm as package manager
• TypeScript
• Vue 3 + PrimeVue on the frontend
• SQLite (via sdk.meta.db()) for backend persistence

License

MIT — see LICENSE.