It fetches the page, renders it so lazily loaded bundles are included, then reads every JavaScript file the page ships. For each of your own files it measures how much a reader gets back as plain code, probes for a public source map, and looks for credentials. Vendor SDKs, third-party domains and dynamic-code sinks are listed separately and do not count.

Out of 100. Code exposure is 75 points, weighted by bytes across your own JavaScript files, so a large readable bundle costs more than a small one. Credentials are 25 points: a private key, cloud secret, payment secret, repository token or database URL costs 25, an unrestricted publishable key 10. A public source map with full source, or a public git repository, caps the score at 10, and a map with mappings only caps it at 50. Emails, IP addresses, browser keys and vendor code do not move the score.

Plain means the file is served as written: names, comments and formatting intact. Minified means names are shortened and whitespace removed, but the structure, strings and property names are intact, and a beautifier restores most of it. Obfuscated means strings and names are hidden and the control flow is rewritten. The Readable column says how much remains: roughly 20 to 30 percent for common open-source obfuscators, under 10 percent for AfterPack output. Source exposed means a public map returns the original.

A value that grants access on its own: private keys, AWS and other cloud secrets, Stripe secret keys, GitHub and GitLab tokens, Slack tokens, database connection strings and bearer tokens. Matches are shown masked with 80 characters of context so you can find them in the file. Rotate any key the scanner finds; obfuscation hides a value from a crawler, and anyone who runs the code can still reach a value it uses.

An email address on a contact page, a public IP, or a Google Maps or Firebase browser key is public by design. Listing them as leaks was the main source of false alarms in the previous scanner. Emails, feature flags, internal hosts and developer comments now appear under "What your code tells a reader", IP addresses and browser keys in a fold under Credentials, both with zero weight.

SDKs and libraries served from your domain, such as an analytics recorder or a UI framework. They are identified by host, path or license banner. No obfuscator should rewrite a vendor's self-updating bundle, and its readability says nothing about your code, so vendor files are listed in their own section and excluded from the score.

A source map chains a shipped file back to the code you wrote, with file names, comments and structure. When the map also embeds the original source, a reader downloads your project as it exists in your editor. The scanner requests the .map file next to each of your largest files, whether or not a file still carries a sourceMappingURL comment. Remove maps from the production build, or block them at the CDN, before anything else.

Remove public source maps, rotate and remove any credential, then run your build through AfterPack. The report names your framework and shows the exact install command; the framework guide covers the rest. A protected build scores in the nineties on this scanner because little of it is readable and nothing in it maps back to source.

Yes. No account, three scans per day per network, and the same scan from npx afterpack audit in a terminal. Results are shareable at their link. A page is rescanned at most every 30 minutes; a repeat scan within that window returns the existing report and does not count toward the limit.

Yes. The AfterPack badge reads Protected by AfterPack while the latest scan verifies it: AfterPack output on the site's own code, no public source maps or credentials, grade A. Otherwise it shows the latest score, or not graded while no scan has graded the site. Every result page has the footer and README snippets.