Information Disclosure: Exposed Config File¶

Identifier: exposed_config_file

Scanner Support¶

Description¶

JavaScript configuration objects exposed on the window object may reveal sensitive information such as API endpoints, authentication tokens, feature flags, internal service URLs, and other configuration details that attackers can access through browser DevTools.

How we test: We analyze client-side JavaScript code and page sources to detect if configuration objects are exposed on the window object (for example window.config, window.env, window.settings). We check for sensitive data such as API keys, tokens, or internal URLs that shouldn't be exposed to client-side code.

Configuration¶

Example¶

Example configuration:

---
security_tests:
  exposed_config_file:
    skip: false

Reference¶

skip¶

Type: boolean

Skip the test if true.