Sourcemap & Env Leak Check

This skill identifies passive security exposures on websites by detecting publicly reachable source maps, sensitive configuration files, and missing security headers. It operates as a read-only auditor, sending standard HTTP requests to identify high-risk assets like .env files, .git directories, and backup scripts that should never be public. The tool prioritizes findings by severity, distinguishing between metadata leaks and full source code exposure.

What it does

• Detects exposed source maps by probing for .map files and identifying embedded source code that reveals original logic and comments.
• Identifies sensitive paths including .env, /.git/HEAD, /wp-config.php~, and database backups.
• Audits security headers to flag the absence of Content-Security-Policy, HSTS, X-Frame-Options, and Referrer-Policy.
• Triages information disclosure by finding metadata files like .DS_Store or exposed status endpoints like /server-status.
• Differentiates catch-all routes to reduce false positives where a server returns a 200 status code for every path.

How it works

1. Initialize the audit by running the bundled Node.js script against a specific URL you are authorized to test.
2. Review the JSON report generated by the tool, which categorizes findings into high, medium, and info severity levels.
3. Analyze incidents starting with high-priority leaks like configuration files or source maps with embedded content.
4. Apply remediation steps using the provided prioritized fix list, tailored to the specific server or framework in use.

Frameworks & tools

This skill requires Node.js (version 18.17 or higher) for its global fetch capability. It is a zero-dependency script that works against any web origin regardless of the underlying backend language or frontend framework.

Why this beats prompting it yourself

Manual prompting cannot reliably probe network endpoints or parse JSON reports for specific security flags like hasSourcesContent. This skill provides a repeatable, scriptable process that accurately distinguishes between a valid file exposure and a generic 404-redirect, ensuring you don't miss hidden source maps that a browser wouldn't normally show.

Use cases

• Auditing a production site after a new deployment to ensure build artifacts were cleaned up.
• Identifying leaked credentials in .env files before they are exploited by automated scanners.
• Verifying that sensitive Git metadata is not accessible via the public web server.
• Checking that security headers meet basic hardening requirements for compliance.

Known limitations

This is a passive scanner and not a full penetration test. It only checks specific known paths and does not perform brute-force attacks or authenticate to private areas.