venu-exe/jsscope

JSScope is a command-line tool written in Python for people who do bug bounty research and security testing. It looks through JavaScript files and web pages to find things that might be useful during a security review: internal addresses, full web links, GraphQL operations, and accidentally exposed credentials. You can point it at a single JavaScript file by URL, give it a web page and ask it to find all the linked scripts on that page, hand it a text file full of URLs, or scan a file already saved on your computer. The tool fetches multiple files at the same time using threads, which keeps scanning reasonably quick when you have a long list of files to check. For each file it scans, JSScope reports back what it found. It extracts endpoint paths like "/api/v1/users" or "/admin/config.json", full URLs it spots in the code, GraphQL operations identified by keywords like "query" or "mutation" or the presence of a "/graphql" path, and patterns that look like leaked secrets. Secret types it watches for include AWS keys, Google API keys, Slack tokens, JWTs, generic API keys, private key blocks, and Firebase URLs. The results are printed to the console grouped by source file, and you can save them to a JSON file with the "-o" flag. The JSON structure lists each source file along with its endpoints, full URLs, GraphQL hits, and any secrets matched, including the secret type and the matched text. The README notes that secret detection uses regular expressions on known key formats, so it will produce both false positives and false negatives. Anyone using it should manually verify a suspected secret before reporting it. The tool also lets you adjust the number of concurrent fetch threads, which matters since bug bounty programs often have rate limits you are expected to respect. The author includes a clear disclaimer: only use this against targets you are authorized to test, such as systems in a bug bounty program you are enrolled in or assets you own. Scanning systems without permission may be illegal.