# Introducing AfterPack Site Security Scanner

A free tool that shows you exactly what your website exposes — leaked secrets, unprotected source code, and more. Scan any site in seconds.

Source: https://www.afterpack.dev/blog/announcing-site-scanner

Published: 2026-03-01 · Author: Nikita Savchenko · Tags: announcement, security

Today we're launching [AfterPack Site Security Scanner](https://www.afterpack.dev/security-scanner) — a free tool that crawls your website with a real browser and tells you exactly what you're exposing to the world. Try it in the browser or run [`npx afterpack audit <url>`](https://www.npmjs.com/package/afterpack) from the terminal.

## What Your Website Is Showing Everyone

Here's something most developers don't think about: every JavaScript file you ship is public. Every inline script, every third-party tag, every source map your build tool quietly generates. It's all there, waiting to be read.

And it's not just readable — it's _searchable_. Automated scanners trawl the web constantly, looking for API keys left in client bundles, source maps that serve your entire project tree, unprotected business logic that a competitor can study in an afternoon. AI models can now summarize and explain minified code in seconds, turning "security through obscurity" into no security at all.

We've seen AWS keys sitting in production bundles. [JWT](https://jwt.io/) tokens hardcoded into authentication flows. Database connection strings embedded in client-side config files. Full source maps exposing original filenames, directory structures, and comments that were never meant to leave the build server.

You might not know this is happening on your site. We built a tool so you can find out.

## What the Scanner Checks

The scanner analyzes your site across seven dimensions, each producing specific findings with severity ratings. Here's what each module looks for — with examples of real findings.

### Secrets Detection

Scans every JavaScript file and source map for exposed credentials — AWS access keys, Stripe secrets, [GitHub](https://github.com) tokens, database URLs, JWTs, and 18 other pattern types. Findings are redacted automatically so sharing results is safe.

- **AWS Access Key Detected** (secrets, critical) — An AWS access key was found in the JavaScript bundle. Value: `AKIA...............7X9Q`. Found in: https://example.com/_next/static/chunks/app/page-a3f8.js
- **Stripe Secret Key** (secrets, high) — A Stripe API key was found in the JavaScript bundle. Value: `sk_live_51N...............8dFq`. Found in: https://example.com/assets/checkout-d41f.js
- **JWT Token** (secrets, high) — A JWT token was found hardcoded in the source. Value: `eyJh..........................E2MjN9`. Found in: https://example.com/static/js/auth-7cb2.js
- **Database Connection String** (secrets, critical) — A database URL was found in the JavaScript bundle. Value: `postgres://admin:...@db.internal:5432/prod`. Found in: sourcemap://src/lib/config.ts

### Protection Level

Classifies each script as obfuscated, minified, unprotected, or source-exposed. If your build is shipping readable code with original variable names, you'll see it here.

### Code Readability

Measures how easily AI can understand your code, scored across keyword density, string exposure, identifier readability, structural clarity, and formatting signals. A high readability score means your logic is an open book.

### Dangerous Patterns

Flags [eval()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval) usage, `Function()` constructors, `document.write()`, direct `innerHTML` assignment, and other patterns that expand your attack surface. Also detects publicly accessible source maps and exposed config files.

- **Source Map Publicly Accessible** (patterns, critical) — A source map file is publicly accessible, exposing original source code. Value: `https://example.com/assets/app.js.map`. Found in: https://example.com/assets/app-8f2a.js
- **eval() Usage Detected** (patterns, high) — Use of eval() allows arbitrary code execution. Value: `eval(atob(config.payload))`. Found in: https://example.com/static/js/main-3dc1.js
- **Exposed Configuration File** (patterns, critical) — A .env file is publicly accessible on the server. Value: `https://example.com/.env`. Found in: https://example.com/.env
- **innerHTML Assignment** (patterns, medium) — Direct innerHTML assignment can lead to XSS vulnerabilities. Value: `el.innerHTML = userContent`. Found in: https://example.com/static/js/render-f19a.js

### Tech Stack Detection

Identifies frameworks and libraries — [React](https://react.dev), [Angular](https://angular.dev), [Vue](https://vuejs.org), [Next.js](https://nextjs.org), [jQuery](https://jquery.com), and more — including version numbers where possible. Knowing what you're running is the first step; knowing that _everyone else_ can see what you're running is the second.

### Third-Party Analysis

Maps every external domain your site loads resources from — scripts, fonts, stylesheets, tracking pixels, API endpoints. Each one is a dependency you didn't write and can't control.

### Bundle Composition

Detects bundled libraries and checks for known [CVEs](https://cve.mitre.org). If you're shipping a version of jQuery or lodash with a published vulnerability, the scanner will flag it.

## How It Works

This isn't a static analyzer that fetches your HTML and calls it a day. The scanner uses [Cloudflare Browser Rendering](https://developers.cloudflare.com/browser-rendering/) to load your site in a real browser, execute JavaScript, and capture every resource that gets loaded — including dynamically injected scripts and lazy-loaded bundles.

Results stream back in real time via [SSE](https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events/Using_server-sent_events). You'll see findings appear as each module completes its analysis, with a running security score that updates progressively from 0 to 100. No waiting for a full report to generate — you're watching the scan happen live.

## It's Free. No Signup.

Enter a URL. Get results. That's it.

No account, no email, no API key. The scanner is completely free to use. We built it because we believe every developer should be able to see what their site exposes — without friction.

## Or Use the CLI

Prefer the terminal? The [`afterpack`](https://www.npmjs.com/package/afterpack) CLI includes the same scanner — one command, no browser needed. You'll need [Node.js](https://nodejs.org) installed (`npx` ships with it):

```bash
npx afterpack audit https://example.com
```

```
  AfterPack v0.3.0 — Security Analyzer

  Scanning https://example.com ...

  ✓ Fetching page
  ✓ Rendering JavaScript
  ✓ Analyzing resources

  ⚠  CRITICAL: AWS Access Key Detected
  ⚠  HIGH: Source Map Publicly Accessible

  ┌─────────────────────────────────────────────┐
  │ Score: 38/100                                                          │
  │                                                                        │
  │ Resources      12 found (4 unprotected, 2 source exposed)              │
  │ Findings       7 issues (1 critical, 2 high, 4 medium)                 │
  │ Tech Stack     React, Next.js, Webpack                                 │
  │ Readability    74/100                                                  │
  └─────────────────────────────────────────────┘

  ⚠  1 critical finding:
     AWS Access Key Detected (AKIA...7X9Q in app/page-a3f8.js)

  Full report: https://afterpack.dev/security-scanner/abc123
```

Drop it into CI or run it before every deploy — catch exposed secrets before they ship.

## Go Scan Your Site

Seriously — [go try it](https://www.afterpack.dev/security-scanner) in the browser, or run `npx afterpack audit <your-url>` in the terminal. Check the secrets tab. Look at your protection levels. See how many third-party domains are loading scripts on your pages.

If everything looks clean, great. You're ahead of most.

If you don't like what you see — that's exactly why we built [AfterPack](https://afterpack.dev). The scanner shows you the problem. AfterPack is the fix for the source-code part: it rewrites your bundle so that reading it, cloning it, or feeding it to a model costs far more than it does today. At the default preset the gzipped bundle comes out about 1.9 to 2.4 times its original size; the [performance page](https://www.afterpack.dev/docs/performance) has the measured numbers.

---

The scanner is live now at [afterpack.dev/security-scanner](https://www.afterpack.dev/security-scanner). Or run `npx afterpack audit <url>` from any terminal — it's on [npm](https://www.npmjs.com/package/afterpack).

If you want to protect what the scanner finds, AfterPack is live: start with the [quickstart](https://www.afterpack.dev/docs/quickstart).

— [Nikita](https://nikitaeverywhere.com)