Secrets without Signatures: An LLM Agent for Logic-Defined Exposures in Recovered JavaScript

Abstract

Secret scanners recognize values with known formats, but a value may become sensitive only through its use. A random string used in a non-standard header for authentication is one example. We examine an LLM workflow for finding such logic-defined exposures in JavaScript recovered by js-recon. SwS uses four class-specific prompts and a coordinator that cross-references their outputs, a shared schema, qualitative triage, and scope-checked verification. Evaluated over 1,500 recovered production targets, SwS proposed 303 logic-defined candidates, 40 verification-eligible, and five verified end-to-end as live, exploitable exposures - including a client-assertion signing bypass surfaced in production JavaScript and confirmed by an independently reproducible offline forgery - while TruffleHog, a format-based baseline, matched none.