Sensitive Data: Private Key Leak in JavaScript Bundle¶

Identifier: js_data_leak_private_key

Scanner(s) Support¶

Description¶

Private cryptographic keys embedded in JavaScript bundles undermine TLS, signing, and encryption controls because anyone can extract the key material from the delivered script. Private keys must never be shipped to browsers or stored in client-side code.

How we test: We statically analyze first-party JavaScript bundles for PEM-encoded private key blocks (-----BEGIN ... PRIVATE KEY-----).

References:

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
• CWE-321: Use of Hard-coded Cryptographic Key
• OWASP Top 10 2025: A04 Cryptographic Failures

Configuration¶

Example¶

Example configuration:

---
security_tests:
  js_data_leak_private_key:
    issues_count_limit: 20
    skip: false

Reference¶

issues_count_limit¶

Type : integer

The maximum number of issues to report. Use 0 to report all issues.

skip¶

Type : boolean

Skip the test if true.