# Website Security Auditor (`zyrox/website-security-auditor`) Actor

A powerful security tool to scan websites for exposed API keys and XSS vulnerabilities.

- **URL**: https://apify.com/zyrox/website-security-auditor.md
- **Developed by:** [HIDDEN GHOST](https://apify.com/zyrox) (community)
- **Categories:** Automation, Developer tools, Other
- **Stats:** 11 total users, 0 monthly users, 0.0% runs succeeded, 1 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per usage

This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-usage

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

````markdown
## 🔍 JS Hunter - Advanced JavaScript Security Scanner

**Automatically discovers and scans ALL JavaScript files on a website for security issues.**

### 🎯 What It Does

This actor automatically:
- ✅ Crawls your target website(s)
- ✅ Finds ALL JavaScript files (external, inline, hidden)
- ✅ Scans for exposed secrets, API keys, and credentials
- ✅ Detects security vulnerabilities (XSS, eval, etc.)
- ✅ Provides actionable recommendations

### 🚀 Features

#### Automatic Discovery
- External JavaScript files (`<script src="...">`)
- Inline JavaScript (`<script>...</script>`)
- Hidden JS files found in HTML source
- Dynamic imports and lazy-loaded scripts
- Optional CDN scanning

#### What It Finds

**CRITICAL Issues:**
- AWS Access Keys & Secret Keys
- Google API Keys
- Firebase Configurations
- Slack Tokens
- Stripe API Keys (Live & Test)
- GitHub Personal Access Tokens
- Private Keys (RSA, DSA, EC)
- JWT Tokens
- Generic API Keys

**HIGH Priority:**
- Internal IP Addresses
- Database Connection Strings
- S3 Bucket URLs
- Hardcoded Passwords

**MEDIUM Priority:**
- API Endpoints
- Admin Panel URLs
- Sensitive URL Parameters

**VULNERABILITIES:**
- DOM XSS Sinks
- Dangerous eval() usage
- SQL Injection patterns

**INFO:**
- Email Addresses
- Internal/Development Domains

### 📊 Input Configuration

```json
{
  "startUrls": [
    {"url": "https://yourwebsite.com"}
  ],
  "maxDepth": 2,
  "includeCdn": false,
  "filterCommonLibraries": true,
  "minConfidence": "MEDIUM"
}
````

#### Parameters Explained

- **startUrls**: Target website(s) to scan
- **maxDepth**: How deep to crawl (1-5)
  - 1 = Only scan the start URL
  - 2 = Scan start URL + all linked pages (recommended)
  - 3+ = Deep crawl (slower)
- **includeCdn**: Scan CDN-hosted libraries (usually not needed)
- **filterCommonLibraries**: Skip jQuery, Bootstrap, etc. (recommended: true)
- **minConfidence**: Result filtering
  - HIGH = Fewer false positives, high accuracy
  - MEDIUM = Balanced (recommended)
  - LOW = More results, may include false positives

### 📤 Output Format

Each finding includes:

```json
{
  "severity": "CRITICAL",
  "type": "AWS Access Key",
  "description": "AWS Access Key ID detected",
  "match": "AKIAIOSFODNN7EXAMPLE",
  "source_file": "https://example.com/config.js",
  "line_number": 45,
  "context": "const config = { awsKey: 'AKIAIOSFODNN7EXAMPLE' }",
  "recommendation": "🚨 Rotate AWS credentials immediately via IAM console.",
  "confidence": "HIGH",
  "timestamp": "2025-11-27T12:30:45"
}
```

#### Summary Report

The last entry in the dataset is a summary:

```json
{
  "type": "SCAN_SUMMARY",
  "data": {
    "scan_info": {
      "target_url": "https://example.com",
      "scan_completed": "2025-11-27T12:35:00"
    },
    "statistics": {
      "scan_duration_seconds": 45.67,
      "urls_crawled": 25,
      "js_files_analyzed": 42,
      "total_findings": 15
    },
    "summary": {
      "critical_findings": 2,
      "high_findings": 5,
      "total_findings": 15
    }
  }
}
```

### 🎯 How It Works

1. **Crawling**: Starts from your target URL and crawls links up to specified depth
2. **JS Discovery**: Finds all JavaScript resources:
   - Parses HTML for `<script>` tags
   - Extracts inline JavaScript
   - Discovers hidden JS files via regex
3. **Smart Filtering**: Skips common libraries (jQuery, Bootstrap, etc.)
4. **Pattern Matching**: Scans code with 30+ regex patterns
5. **Validation**: Each finding is validated to reduce false positives
6. **Confidence Scoring**: Assigns HIGH/MEDIUM/LOW confidence
7. **Reporting**: Outputs clean JSON with actionable recommendations

### 💡 Best Practices

1. **Start with depth 2** - Good balance of coverage vs speed
2. **Enable library filtering** - Reduces noise from third-party code
3. **Use MEDIUM confidence** - Best accuracy/coverage balance
4. **Review CRITICAL findings first** - Immediate security risks
5. **Check context** - Verify findings aren't false positives

### ⚠️ Important Notes

- This tool is for **security research and authorized testing only**
- Only scan websites you own or have permission to test
- Some findings may be false positives - always verify
- Large websites may take several minutes to scan
- Rate limiting may occur on some websites

### 🔧 Troubleshooting

**No results found?**

- Check if website blocks automated tools
- Try increasing maxDepth
- Verify URLs are accessible

**Too many false positives?**

- Set minConfidence to "HIGH"
- Enable filterCommonLibraries
- Disable includeCdn

**Scan taking too long?**

- Reduce maxDepth to 1
- Enable filterCommonLibraries
- Scan specific pages instead of entire site

# Actor input Schema

## `startUrls` (type: `array`):

List of websites to scan. The scanner will crawl these URLs and analyze all JavaScript files found.

## `maxDepth` (type: `integer`):

Maximum depth for crawling links (1 = only start URL, 2 = start URL + 1 level of links, etc.)

## `includeCdn` (type: `boolean`):

Include JavaScript files hosted on CDNs (unpkg, cdnjs, jsdelivr, etc.). Warning: This will scan third-party libraries.

## `filterCommonLibraries` (type: `boolean`):

Skip scanning common JavaScript libraries like jQuery, Bootstrap, React, etc. Recommended: true

## `minConfidence` (type: `string`):

Only report findings with this confidence level or higher. HIGH = fewer false positives.

## Actor input object example

```json
{
  "startUrls": [
    {
      "url": "https://example.com"
    }
  ],
  "maxDepth": 2,
  "includeCdn": false,
  "filterCommonLibraries": true,
  "minConfidence": "MEDIUM"
}
```

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "startUrls": [
        {
            "url": "https://example.com"
        }
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("zyrox/website-security-auditor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "startUrls": [{ "url": "https://example.com" }] }

# Run the Actor and wait for it to finish
run = client.actor("zyrox/website-security-auditor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "startUrls": [
    {
      "url": "https://example.com"
    }
  ]
}' |
apify call zyrox/website-security-auditor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,zyrox/website-security-auditor"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/t4AbuyVuPaZGKiYn3/builds/XFH5Ft7ojcnGQUJOp/openapi.json