AI-Powered JavaScript Security Audit Tool
🔍 Crawl · 🤖 Analyze · 📄 Report · 💬 Chat
Let AI uncover the gold in your JS files — quietly and efficiently.
Js-Scanner automates the nightmare of manually digging through JavaScript files for API endpoints, hardcoded secrets, JWTs, and sensitive data. It crawls every JS file on a target site, runs them through AI (DeepSeek / OpenAI / local models), and produces a beautiful interactive HTML report — then lets you keep asking questions in a chat-like dialog.
flowchart LR
A[🌐 Target URL] --> B[🕸️ Crawl JS Files]
B --> C[💾 Download Locally]
C --> D[🤖 AI Analysis]
D --> E[📄 HTML Report]
D --> F[💬 Dialog Mode]
F -->|New URL| B
| 🕸️ Headless Crawler | Automatically discovers every JS file using Playwright, bypasses SSL errors |
| 🤖 Multi-Model AI | Supports DeepSeek, OpenAI, and local Ollama models |
| 🔐 Deep Scan | Finds API endpoints, hardcoded keys, JWT tokens, secrets, PII, internal IPs |
| 🖥️ Interactive Report | Expand/collapse files, one-click copy all findings or just API endpoints |
| 💬 Chat Mode | Ask follow-up questions about findings — or paste a new URL to scan |
| 📦 Portable EXE | Package as a single-file Windows executable with no Python needed |
# Clone
git clone https://github.com/riteshekbote/Js-Scanner.git
cd Js-Scanner
# Dependencies
pip install -r requirements.txt
playwright install chromiumCreate config.ini in the project root:
[AI]api_base = https://api.deepseek.com
api_key = sk-your-actual-key
model = deepseek-chat
temperature = 0.1
max_tokens = 8192
min_confidence = 0.0
[App]report_dir = reports
cache_dir = js_cache
auto_open_report = falseInteractive mode (recommended):
python src/main.pySingle scan:
python src/main.py https://example.com| Config | Values | Description |
|---|---|---|
api_base | URL | OpenAI-compatible API endpoint |
api_key | string | Your API key |
model | string | Model name (deepseek-chat, gpt-4o-mini, llama3, etc.) |
temperature | 0.0 – 1.0 | Lower = more deterministic output (audit: 0.1) |
max_tokens | int | Max tokens per AI response |
min_confidence | 0.0 – 1.0 | Filters findings below this threshold (0.0 = keep all) |
report_dir | path | Where HTML reports are saved |
cache_dir | path | Where downloaded JS files are cached |
auto_open_report | true / false | Auto-open report in browser (Windows) |
| Provider | api_base | api_key | model |
|---|---|---|---|
| DeepSeek | https://api.deepseek.com | Your DeepSeek key | deepseek-chat |
| OpenAI | https://api.openai.com/v1 | Your OpenAI key | gpt-4o-mini |
| Ollama (local) | http://localhost:11434/v1 | Any string (ollama) | llama3 / your model |
After a scan, you get an interactive HTML report that looks like this:
┌─────────────────────────────────────────────────────────────┐
│ 🔒 JS Security Audit Report │
│ Target: https://example.com │
│ Generated: 2025-01-15 14:30:22 │
├────────────────┬────────────────┬──────────────┬────────────┤
│ Files Scanned │ Findings │ Critical Risk│ High Risk │
│ 12 │ 47 │ 3 │ 11 │
├────────────────┴────────────────┴──────────────┴────────────┤
│ Leak Type Distribution │
│ api_endpoint: 24 hardcoded_secret: 8 jwt_token: 6 │
│ phone_number: 5 internal_ip: 3 email: 1 │
├─────────────────────────────────────────────────────────────┤
│ 📁 Detailed Analysis Results │
│ │
│ 📄 app.bundle.js ⚠️ 8 findings │
│ ┌─────────┬────────────────────┬──────────────────┬────────┐│
│ │ Type │ Leaked Content │ Code Context │ Risk ││
│ ├─────────┼────────────────────┼──────────────────┼────────┤│
│ │ api_ep │ /api/admin/users │ line 142: url: │ HIGH ││
│ │ hardc… │ sk_live_xxxxxxxx │ line 67: secret │ CRIT ││
│ │ jwt_t… │ eyJhbGciOiJIUzI1… │ line 203: token │ HIGH ││
│ └─────────┴────────────────────┴──────────────────┴────────┘│
│ │
│ 📄 config.js ⚠️ 3 findings │
│ ... │
└─────────────────────────────────────────────────────────────┘
The report includes:
- 📊 Stats cards — files scanned, total findings, critical & high-risk counts
- 🏷️ Type distribution — API endpoints, hardcoded secrets, PII, and more
- 🔍 Per-file drilldown — type, leaked value, code context, risk level, fix suggestion, confidence %
- 📋 One-click copy — all findings as TSV (paste into Excel) or just API endpoints
After an audit, you enter an interactive chat with the AI:
🔍 You: what does the secret_key in config.js do?
🤖 AI: That looks like a Stripe API secret key starting with sk_live_. It's a production key — anyone with access can charge real cards.
🔍 You: https://another-site.com
🔄 New URL detected, starting audit...
✅ New audit complete, context updated.
Commands: exit / quit / help / clear / history
Build a standalone Windows EXE:
python build_exe.pyOutput: dist/API_Agent.exe — no Python environment required.
⚠️ The target machine still needs Playwright browsers. Runplaywright install chromiumon it.
🔴 SSL certificate errors?
The tool already ignores SSL errors (verify=False in both Playwright and requests). If it still fails, check that the target site is actually reachable.
⚪ AI returns nothing / report is empty?
- Verify
api_keyinconfig.ini - Try
min_confidence = 0.0 - Make sure your model supports OpenAI-compatible chat completions
🟡 Too many false positives?
Raise min_confidence (e.g. 0.7). You can also extend is_likely_placeholder() in ai_analyzer.py.
🔄 Scan a new site mid-session?
Just paste the URL into the dialog — the agent detects it, scans, and updates context automatically.
🔐 Analyze authenticated/logged-in sites?
No built-in auth yet. Modify crawler.py to inject cookies via page.context.add_cookies([...]).
📁 Analyze local JS files?
Designed for live websites. For local files, enter a file path as the URL (not recommended) or extend the code yourself.
- Custom rules — edit the
promptandis_likely_placeholder()inai_analyzer.py - Truncation — change
max_charsinai_analyzer.py(default: 300,000 chars) - Batch scans — loop in a shell script:
forurlin$(cat targets.txt);do python src/main.py "$url";done
| Component | Library |
|---|---|
| 🤖 AI Client | openai |
| 🕸️ Headless Browser | playwright |
| 📄 Report Engine | jinja2 |
| 🌐 HTTP Client | requests |
This tool is for authorized security testing and self code review only.
Do not use it on systems you do not own or have explicit permission to test.
AI analysis may produce false positives or miss real issues — always manually verify critical findings.
MIT © riteshekbote
⭐ Found this useful? Give it a star!