LeakLens

LeakLens is a web-aware secrets scanner for source code, Git history, local files, direct URLs, and modern JavaScript-heavy web applications.

It is our own tool and repository. It started from the original Praetorian Titus codebase, keeps the high-performance secret scanning engine and rule lineage, and adds a web-app workflow around crawling, JavaScript discovery, source-map recovery, and JS intelligence artifacts.

LeakLens uses ProjectDiscovery Katana for crawling. The JS intelligence layer is inspired by concepts from PortSwigger js-miner, but it is implemented in LeakLens as a separate informational layer. LeakLens secret findings still come from the scanner rule engine.

Use LeakLens only on codebases, repositories, and websites you are authorized to test.

Current Focus

• CLI scanning for files, directories, Git repositories, direct URLs, and crawled websites.
• Secret detection with optional live validation.
• Web crawling for JS/JSON discovery using Katana.
• URL repair for same-host JS paths that are resolved too deeply by crawlers.
• JS intelligence for endpoints, source maps, cloud URLs, subdomains, dependencies, and opt-in dependency-confusion checks.
• Go library usage for embedding the scanner in other internal tools.

Install

LeakLens supports two install paths:

• Install from source with go install.
• Build locally with optional Vectorscan/Hyperscan acceleration.

Go Install

go install installs directly from the GitHub repository and writes the binary to $(go env GOPATH)/bin. Make sure that directory is in your PATH. Use @main to install the latest tested LeakLens branch.

Pure-Go install:

go install github.com/dinosn/leaklens/cmd/leaklens@main

Accelerated install with Vectorscan/Hyperscan:

CGO_ENABLED=1 go install -tags vectorscan github.com/dinosn/leaklens/cmd/leaklens@main

Local Build

Build the portable pure-Go binary:

make build-pure

The binary is written to:

dist/leaklens

Build with Vectorscan/Hyperscan acceleration:

make build

The default make build target uses CGO and the vectorscan build tag. It requires a compatible native library and pkg-config.

Install native dependencies:

# macOS
brew install vectorscan pkg-config

# Ubuntu/Debian
sudo apt-get update
sudo apt-get install -y pkg-config libhyperscan-dev

# Fedora/RHEL
sudo dnf install -y pkgconf-pkg-config hyperscan-devel

On macOS, Homebrew installs Vectorscan under the active Homebrew prefix. If pkg-config cannot find libhs, export the package-config path:

export PKG_CONFIG_PATH="$(brew --prefix vectorscan)/lib/pkgconfig:$PKG_CONFIG_PATH"

Use matching architectures for Go and the native library. For example, an x86_64 Go toolchain cannot link an arm64 Homebrew Vectorscan library. If the architecture does not match, either install a matching Go toolchain/native library pair or use make build-pure.

On Apple Silicon, this linker error means Go is running as amd64 while Homebrew Vectorscan is arm64:

ld: warning: ignoring file '/opt/homebrew/.../libhs.dylib': found architecture 'arm64', required architecture 'x86_64'
Undefined symbols for architecture x86_64: "_hs_*"

Preferred fix: use an arm64 Go toolchain with the arm64 Homebrew libraries:

brew install go vectorscan pkg-config
export PATH="/opt/homebrew/bin:$PATH"
go env -u GOARCH
go env -u GOOS
export PKG_CONFIG_PATH="$(brew --prefix vectorscan)/lib/pkgconfig:$PKG_CONFIG_PATH"
CGO_ENABLED=1 go install -tags vectorscan github.com/dinosn/leaklens/cmd/leaklens@main

Fallback without native acceleration:

CGO_ENABLED=0 go install github.com/dinosn/leaklens/cmd/leaklens@main

Version and Updates

Check the installed build:

leaklens version

Check GitHub for the latest published release:

leaklens update

LeakLens also performs a short release check when a command starts. The automatic notification is written to stderr so scan output stays parseable. It reports latest, outdated, development-build, or unknown status when a GitHub release exists. If no release has been published yet, normal scans stay quiet and leaklens update reports that state explicitly.

Disable the automatic check for scripted runs:

leaklens --no-update-check scan path/to/source
LEAKLENS_NO_UPDATE_CHECK=true leaklens scan path/to/source

Quick Start

# Scan a file
leaklens scan path/to/file.txt

# Scan a directory
leaklens scan path/to/source

# Scan Git history
leaklens scan --git path/to/repo

# Scan a direct URL
leaklens scan https://example.com/static/app.js

# Scan URLs from a file
leaklens scan --url-file urls.txt

# Crawl a website and scan discovered JS/JSON files
leaklens scan --crawl https://example.com

# Crawl with JS intelligence and source-map rescanning
leaklens scan --crawl --js-intel https://example.com

# Validate detected secrets against provider APIs
leaklens scan path/to/source --validate

By default, scan results are printed in human format and stored in leaklens.ds. Use --output :memory: when you do not want a datastore.

Website Testing

Default web-app crawl profile:

leaklens scan --crawl https://example.com

This default profile enables:

• standard crawling without launching Chrome
• --crawl-js-crawl=true
• --crawl-depth=3
• --crawl-concurrency=2
• --crawl-rate-limit=3
• --crawl-timeout=2m
• --crawl-extensions=js,json
• --crawl-scope=rdn

Use headless crawling only when the standard crawler misses browser-rendered assets:

leaklens scan --crawl --crawl-headless https://example.com

For richer web-app triage:

leaklens scan --crawl --js-intel https://example.com

For applications where JavaScript-discovered relative paths are resolved under the wrong directory, set the application root explicitly:

leaklens scan --crawl --js-intel \
  --crawl-base-url https://example.com/app/ \
  https://example.com/app/static/js/main.js

LeakLens keeps the crawler-discovered URL as the primary candidate and then tries same-host repaired candidates. When a fallback succeeds, human output shows a repaired: line.

JS Intelligence

Enable the JS intelligence layer with:

leaklens scan --crawl --js-intel https://example.com

This layer reports supporting artifacts. It does not replace the normal LeakLens secret rules.

Useful examples:

# Include masked low-confidence generic JS assignments
leaklens scan --crawl --js-intel --js-intel-generic-secrets https://example.com

# Actively check discovered npm packages for public-registry misses
leaklens scan --crawl --js-intel --js-intel-npm-check https://example.com

# Disable inline source-map parsing while keeping other JS intelligence
leaklens scan --crawl --js-intel --js-intel-source-maps=false https://example.com

For json and sarif scan output, source-map-derived secret matches are included through the normal result path. Informational JS intelligence is currently printed in human output only, so machine-readable secret outputs stay stable.

Scan Command

leaklens scan [target] [flags]

Targets can be:

• A local file or directory.
• A local Git repository.
• A direct HTTP(S) URL.
• A GitHub repository reference such as github.com/org/repo.
• A GitLab project reference such as gitlab.com/group/project.

Core Flags

Extraction Flags

Crawl Flags

JS Intelligence Flags

GitHub and GitLab

Direct repository references work through scan:

leaklens scan github.com/org/repo
leaklens scan gitlab.com/group/project

Use dedicated commands for org, user, group, and token-aware workflows:

# GitHub repository
leaklens github org/repo

# GitHub organization
leaklens github --org my-org --token "$GITHUB_TOKEN"

# GitLab project
leaklens gitlab group/project

# GitLab group
leaklens gitlab --group my-group --token "$GITLAB_TOKEN"

Important flags:

Reports and Exploration

Scan results are stored in a datastore unless --output :memory: is used.

```bash

Human report from default datastore

leaklens report

JSON report

leaklens report --format json

SARIF report

leaklens report --format sarif

Report from a specific datastore

leaklens report --datastore path/to/leaklens.ds

TUI exploration

leaklens explore --datastore path/to/lea