How can I quickly scan my single-page app for exposed secrets and vulnerable third - party scripts?

Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.

Key takeaways

• Decloak’s free scan runs in ~15 seconds, needs no account, and checks both secret exposure and vulnerable third - party scripts.
• Layer 4 flags known vulnerable JavaScript libraries and dangerous patterns like eval().
• Layer 7 identifies exposed service_role keys or other platform - specific secrets that ended up in client code.
• No installation required; just paste your SPA URL into the web UI.

How does Decloak detect exposed secrets in a SPA?

Decloak’s free scan examines every file that the browser can request, including inline scripts, external JavaScript bundles and HTML comments. It flags any high - entropy string that looks like an AWS, Google, Stripe or GitHub key, as well as JWTs and private - key blocks. The finding shows the exact location (file and line) but never stores the secret itself, proving the exposure without keeping a copy.

Steps

1. Open the free Decloak scanner at https://decloak.com/scan.
2. Paste the public URL of your single - page app and press Start Scan.
3. Wait ~15 seconds for the report to appear.
4. In the JavaScript CVE section (Layer 4) look for entries labeled Potential secret in JavaScript - each entry lists the file and a redacted snippet.

How does Decloak find vulnerable third - party scripts?

Layer 4 uses the Retire.js vulnerability database to match library names and versions found in every <script src> tag or bundled file. It also flags dangerous code patterns such as eval(), innerHTML sinks and wildcard postMessage targets. Layer 7 adds platform - specific checks; for example, if a Supabase service_role key appears in client - side code it will be reported as a publicly readable database credential.

Steps

1. After the scan finishes, expand the JavaScript CVE section.
2. Review entries that list a library name, version and CVE ID (e.g., jquery 3.4.0 - CVE - 2019 - 11358).
3. Check the dangerous pattern subsection for eval() or missing Subresource Integrity (integrity attribute).
4. If the report shows a publicly readable Supabase table or exposed service_role key, treat it as a critical secret leak.

What does the free scan cover?

The free tier runs eight core layers:

1. HTTP/TLS posture
2. Static HTML analysis
3. Rendered - page network behaviour
4. JavaScript CVE scanning (vulnerable libraries, dangerous patterns, secret strings)
5. Tag manager intelligence
6. Third - party domain mapping
7. Vibe - coded platform security (exposed platform secrets)
8. AI - written executive summary All of these run without authentication and return a graded, shareable report in about 15 seconds.

When should I move beyond the free scan?

If you need deeper CI/CD integration, consider the paid tiers:

• Starter adds DNS/TLS deep analysis and subdomain takeover detection (Layer 9).
• Enterprise includes Active Security Testing (Layer 8) and AI - Pentesting, which actually attempts exploitation of findings such as vulnerable libraries. These layers provide confirmation that a vulnerability is exploitable, but the free scan already gives you a reliable snapshot of secret exposure and library risk.

Quick checklist for a pre - audit SPA review

How to act on the findings

1. Remove or rotate any secret that appears in the report. Move it to a server - side environment variable and reference it via a backend endpoint.
2. Upgrade vulnerable libraries to the latest patched version. If you cannot upgrade immediately, add Subresource Integrity with the correct hash and consider loading the library from a trusted CDN.
3. Add integrity= attributes to all external scripts and stylesheets.
4. Fix mixed content by updating all http:// URLs to https:// or proxying them through a secure endpoint.
5. Enable platform security controls - for Supabase enable Row Level Security on every table and never ship the service_role key to the client.
6. Re - run the free Decloak scan to confirm the issues are resolved before the formal audit.

Where to learn more

• Decloak’s free scan overview page explains the eight core layers and how the report is generated.
• The journal post AI Pentesting Explained: What It Is, Who It’s For and What Decloak Offers details how the Active Testing layer confirms exploitability.
• For compliance mapping, see Compliance Mapping Explained.

Running Decloak’s free scan gives you a fast, evidence - backed view of secret exposure and vulnerable scripts, letting you fix the most critical problems before an auditor walks through your code.