Preprint Open access
Secrets That Survive Everything: Runtime Credential Exposure in Production Web Applications
Pre-deployment secret scanning operates only on source code, never on what a production application serves. We document two exploitation chains in which Azure AD client credentials and APIM subscription keys from production JavaScript bundles enabled account takeover and mass data exposure. An authorized engagement cov …