Open Daily: 10am - 10pm | Alley door pickup 10am - 7pm 3038 Hennepin Ave Minneapolis, MN
612-822-4611

  • Open Daily: 10am - 10pm
    Alley-side Pickup: 10am - 7pm

    3038 Hennepin Ave Minneapolis, MN
    612-822-4611

Open Daily: 10am - 10pm | Alley-side Pickup: 10am - 7pm
3038 Hennepin Ave Minneapolis, MN
612-822-4611
Secrets in the Browser: Detecting and Remediating Client-Side Credential Exposure

Secrets in the Browser: Detecting and Remediating Client-Side Credential Exposure

Gorijala, Hemanth

Paperback

ProgrammingComputer Security

ISBN13: 9798190281941
Publisher: Independently Published
Published: Aug 2 2026
Pages: 340
Weight: 1.00
Height: 0.71 Width: 6.00 Depth: 9.00
Language: English
Modern security programs scan repositories, pull requests, and pipelines for secrets. Those controls are necessary, but they answer only one question: is the source clean. They do not prove what the deployed application actually serves to a browser after it is built, configured, and running.

Single-page applications, cloud-backed front ends, API gateways, runtime configuration, and source maps create paths where a credential appears only after source review. A build step can inline a secret into a JavaScript bundle. A runtime endpoint can serve it live. A source map can reveal it. In each case the repository is clean and the served application is not.

Secrets in the Browser is a practitioner field guide to that gap. You will learn the five structural paths that deliver credentials to clients; why DAST scanners crawl the right files but do not classify credential-grade values inside JavaScript, JSON, XML, source maps, and API responses; how to inspect live traffic and classify public identifiers versus credential-grade values; step-by-step remediation using PKCE, the backend-for-frontend pattern, API gateways, managed identity, vaults, and CI/CD release gates; and how to scan source, build artifacts, and runtime.

Written for application-security engineers, penetration testers, DevSecOps and platform engineers, frontend and full-stack developers, and the engineering leaders who set release standards. All examples are synthetic.

Also in

Computer Security

View All