# Website Security Auditor (`zyrox/website-security-auditor`) Actor

A powerful security tool to scan websites for exposed API keys and XSS vulnerabilities.

- **URL**: https://apify.com/zyrox/website-security-auditor.md
- **Developed by:** [HIDDEN GHOST](https://apify.com/zyrox) (community)
- **Categories:** Automation, Developer tools, Other
- **Stats:** 11 total users, 0 monthly users, 0.0% runs succeeded, 1 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per usage

This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-usage

## What's an Apify Actor?

Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md):

```bash
npm install apify-client
```

In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md):

```bash
pip install apify-client
```

In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md):

````bash
# MacOS / Linux
curl -fsSL https://apify.com/install-cli.sh | bash
# Windows
irm https://apify.com/install-cli.ps1 | iex
```bash

In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md).

If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).


# README

```markdown
## 🔍 JS Hunter - Advanced JavaScript Security Scanner

**Automatically discovers and scans ALL JavaScript files on a website for security issues.**

### 🎯 What It Does

This actor automatically:
- ✅ Crawls your target website(s)
- ✅ Finds ALL JavaScript files (external, inline, hidden)
- ✅ Scans for exposed secrets, API keys, and credentials
- ✅ Detects security vulnerabilities (XSS, eval, etc.)
- ✅ Provides actionable recommendations

### 🚀 Features

#### Automatic Discovery
- External JavaScript files (`<script src="...">`)
- Inline JavaScript (`<script>...</script>`)
- Hidden JS files found in HTML source
- Dynamic imports and lazy-loaded scripts
- Optional CDN scanning

#### What It Finds

**CRITICAL Issues:**
- AWS Access Keys & Secret Keys
- Google API Keys
- Firebase Configurations
- Slack Tokens
- Stripe API Keys (Live & Test)
- GitHub Personal Access Tokens
- Private Keys (RSA, DSA, EC)
- JWT Tokens
- Generic API Keys

**HIGH Priority:**
- Internal IP Addresses
- Database Connection Strings
- S3 Bucket URLs
- Hardcoded Passwords

**MEDIUM Priority:**
- API Endpoints
- Admin Panel URLs
- Sensitive URL Parameters

**VULNERABILITIES:**
- DOM XSS Sinks
- Dangerous eval() usage
- SQL Injection patterns

**INFO:**
- Email Addresses
- Internal/Development Domains

### 📊 Input Configuration

```json
{
  "startUrls": [
    {"url": "https://yourwebsite.com"}
  ],
  "maxDepth": 2,
  "includeCdn": false,
  "filterCommonLibraries": true,
  "minConfidence": "MEDIUM"
}
````

#### Parameters Explained

- **startUrls**: Target website(s) to scan
- **maxDepth**: How deep to crawl (1-5)
  - 1 = Only scan the start URL
  - 2 = Scan start URL + all linked pages (recommended)
  - 3+ = Deep crawl (slower)
- **includeCdn**: Scan CDN-hosted libraries (usually not needed)
- **filterCommonLibraries**: Skip jQuery, Bootstrap, etc. (recommended: true)
- **minConfidence**: Result filtering
  - HIGH = Fewer false positives, high accuracy
  - MEDIUM = Balanced (recommended)
  - LOW = More results, may include false positives

### 📤 Output Format

Each finding includes:

```json
{
  "severity": "CRITICAL",
  "type": "AWS Access Key",
  "description": "AWS Access Key ID detected",
  "match": "AKIAIOSFODNN7EXAMPLE",
  "source_file": "https://example.com/config.js",
  "line_number": 45,
  "context": "const config = { awsKey: 'AKIAIOSFODNN7EXAMPLE' }",
  "recommendation": "🚨 Rotate AWS credentials immediately via IAM console.",
  "confidence": "HIGH",
  "timestamp": "2025-11-27T12:30:45"
}
```

#### Summary Report

The last entry in the dataset is a summary:

```json
{
  "type": "SCAN_SUMMARY",
  "data": {
    "scan_info": {
      "target_url": "https://example.com",
      "scan_completed": "2025-11-27T12:35:00"
    },
    "statistics": {
      "scan_duration_seconds": 45.67,
      "urls_crawled": 25,
      "js_files_analyzed": 42,
      "total_findings": 15
    },
    "summary": {
      "critical_findings": 2,
      "high_findings": 5,
      "total_findings": 15
    }
  }
}
```

### 🎯 How It Works

1. **Crawling**: Starts from your target URL and crawls links up to specified depth
2. **JS Discovery**: Finds all JavaScript resources:
   - Parses HTML for `<script>` tags
   - Extracts inline JavaScript
   - Discovers hidden JS files via regex
3. **Smart Filtering**: Skips common libraries (jQuery, Bootstrap, etc.)
4. **Pattern Matching**: Scans code with 30+ regex patterns
5. **Validation**: Each finding is validated to reduce false positives
6. **Confidence Scoring**: Assigns HIGH/MEDIUM/LOW confidence
7. **Reporting**: Outputs clean JSON with actionable recommendations

### 💡 Best Practices

1. **Start with depth 2** - Good balance of coverage vs speed
2. **Enable library filtering** - Reduces noise from third-party code
3. **Use MEDIUM confidence** - Best accuracy/coverage balance
4. **Review CRITICAL findings first** - Immediate security risks
5. **Check context** - Verify findings aren't false positives

### ⚠️ Important Notes

- This tool is for **security research and authorized testing only**
- Only scan websites you own or have permission to test
- Some findings may be false positives - always verify
- Large websites may take several minutes to scan
- Rate limiting may occur on some websites

### 🔧 Troubleshooting

**No results found?**

- Check if website blocks automated tools
- Try increasing maxDepth
- Verify URLs are accessible

**Too many false positives?**

- Set minConfidence to "HIGH"
- Enable filterCommonLibraries
- Disable includeCdn

**Scan taking too long?**

- Reduce maxDepth to 1
- Enable filterCommonLibraries
- Scan specific pages instead of entire site

# Actor input Schema

## `startUrls` (type: `array`):

List of websites to scan. The scanner will crawl these URLs and analyze all JavaScript files found.

## `maxDepth` (type: `integer`):

Maximum depth for crawling links (1 = only start URL, 2 = start URL + 1 level of links, etc.)

## `includeCdn` (type: `boolean`):

Include JavaScript files hosted on CDNs (unpkg, cdnjs, jsdelivr, etc.). Warning: This will scan third-party libraries.

## `filterCommonLibraries` (type: `boolean`):

Skip scanning common JavaScript libraries like jQuery, Bootstrap, React, etc. Recommended: true

## `minConfidence` (type: `string`):

Only report findings with this confidence level or higher. HIGH = fewer false positives.

## Actor input object example

```json
{
  "startUrls": [
    {
      "url": "https://example.com"
    }
  ],
  "maxDepth": 2,
  "includeCdn": false,
  "filterCommonLibraries": true,
  "minConfidence": "MEDIUM"
}
```

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "startUrls": [
        {
            "url": "https://example.com"
        }
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("zyrox/website-security-auditor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "startUrls": [{ "url": "https://example.com" }] }

# Run the Actor and wait for it to finish
run = client.actor("zyrox/website-security-auditor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "startUrls": [
    {
      "url": "https://example.com"
    }
  ]
}' |
apify call zyrox/website-security-auditor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=zyrox/website-security-auditor",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

```json
{
    "openapi": "3.0.1",
    "info": {
        "title": "Website Security Auditor",
        "description": "A powerful security tool to scan websites for exposed API keys and XSS vulnerabilities.",
        "version": "0.0",
        "x-build-id": "XFH5Ft7ojcnGQUJOp"
    },
    "servers": [
        {
            "url": "https://api.apify.com/v2"
        }
    ],
    "paths": {
        "/acts/zyrox~website-security-auditor/run-sync-get-dataset-items": {
            "post": {
                "operationId": "run-sync-get-dataset-items-zyrox-website-security-auditor",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK"
                    }
                }
            }
        },
        "/acts/zyrox~website-security-auditor/runs": {
            "post": {
                "operationId": "runs-sync-zyrox-website-security-auditor",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor and returns information about the initiated run in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK",
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/runsResponseSchema"
                                }
                            }
                        }
                    }
                }
            }
        },
        "/acts/zyrox~website-security-auditor/run-sync": {
            "post": {
                "operationId": "run-sync-zyrox-website-security-auditor",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK"
                    }
                }
            }
        }
    },
    "components": {
        "schemas": {
            "inputSchema": {
                "type": "object",
                "required": [
                    "startUrls"
                ],
                "properties": {
                    "startUrls": {
                        "title": "Target URLs",
                        "type": "array",
                        "description": "List of websites to scan. The scanner will crawl these URLs and analyze all JavaScript files found.",
                        "items": {
                            "type": "object",
                            "required": [
                                "url"
                            ],
                            "properties": {
                                "url": {
                                    "type": "string",
                                    "title": "URL of a web page",
                                    "format": "uri"
                                }
                            }
                        }
                    },
                    "maxDepth": {
                        "title": "Crawl Depth",
                        "minimum": 1,
                        "maximum": 5,
                        "type": "integer",
                        "description": "Maximum depth for crawling links (1 = only start URL, 2 = start URL + 1 level of links, etc.)",
                        "default": 2
                    },
                    "includeCdn": {
                        "title": "Scan CDN Files",
                        "type": "boolean",
                        "description": "Include JavaScript files hosted on CDNs (unpkg, cdnjs, jsdelivr, etc.). Warning: This will scan third-party libraries.",
                        "default": false
                    },
                    "filterCommonLibraries": {
                        "title": "Filter Common Libraries",
                        "type": "boolean",
                        "description": "Skip scanning common JavaScript libraries like jQuery, Bootstrap, React, etc. Recommended: true",
                        "default": true
                    },
                    "minConfidence": {
                        "title": "Minimum Confidence Level",
                        "enum": [
                            "HIGH",
                            "MEDIUM",
                            "LOW"
                        ],
                        "type": "string",
                        "description": "Only report findings with this confidence level or higher. HIGH = fewer false positives.",
                        "default": "MEDIUM"
                    }
                }
            },
            "runsResponseSchema": {
                "type": "object",
                "properties": {
                    "data": {
                        "type": "object",
                        "properties": {
                            "id": {
                                "type": "string"
                            },
                            "actId": {
                                "type": "string"
                            },
                            "userId": {
                                "type": "string"
                            },
                            "startedAt": {
                                "type": "string",
                                "format": "date-time",
                                "example": "2025-01-08T00:00:00.000Z"
                            },
                            "finishedAt": {
                                "type": "string",
                                "format": "date-time",
                                "example": "2025-01-08T00:00:00.000Z"
                            },
                            "status": {
                                "type": "string",
                                "example": "READY"
                            },
                            "meta": {
                                "type": "object",
                                "properties": {
                                    "origin": {
                                        "type": "string",
                                        "example": "API"
                                    },
                                    "userAgent": {
                                        "type": "string"
                                    }
                                }
                            },
                            "stats": {
                                "type": "object",
                                "properties": {
                                    "inputBodyLen": {
                                        "type": "integer",
                                        "example": 2000
                                    },
                                    "rebootCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "restartCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "resurrectCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "computeUnits": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            },
                            "options": {
                                "type": "object",
                                "properties": {
                                    "build": {
                                        "type": "string",
                                        "example": "latest"
                                    },
                                    "timeoutSecs": {
                                        "type": "integer",
                                        "example": 300
                                    },
                                    "memoryMbytes": {
                                        "type": "integer",
                                        "example": 1024
                                    },
                                    "diskMbytes": {
                                        "type": "integer",
                                        "example": 2048
                                    }
                                }
                            },
                            "buildId": {
                                "type": "string"
                            },
                            "defaultKeyValueStoreId": {
                                "type": "string"
                            },
                            "defaultDatasetId": {
                                "type": "string"
                            },
                            "defaultRequestQueueId": {
                                "type": "string"
                            },
                            "buildNumber": {
                                "type": "string",
                                "example": "1.0.0"
                            },
                            "containerUrl": {
                                "type": "string"
                            },
                            "usage": {
                                "type": "object",
                                "properties": {
                                    "ACTOR_COMPUTE_UNITS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_WRITES": {
                                        "type": "integer",
                                        "example": 1
                                    },
                                    "KEY_VALUE_STORE_LISTS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_INTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_EXTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_SERPS": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            },
                            "usageTotalUsd": {
                                "type": "number",
                                "example": 0.00005
                            },
                            "usageUsd": {
                                "type": "object",
                                "properties": {
                                    "ACTOR_COMPUTE_UNITS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_WRITES": {
                                        "type": "number",
                                        "example": 0.00005
                                    },
                                    "KEY_VALUE_STORE_LISTS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_INTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_EXTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_SERPS": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}
```