PRISM

PRISM - Advanced browser-based secret scanner that reveals invisible security risks. Refracting the web to find hidden secrets.

PRISM is a lightweight browser extension designed for security engineers and bug bounty hunters. It performs passive scanning on web pages to detect exposed secrets (API keys, tokens, credentials) and sensitive information in client-side code. 🔍 KEY FEATURES: ━━━━━━━━━━━━━━━━━━ - Passive Scanning: Automatically scans HTML, inline scripts, and external JS/CSS files - Real-Time Alerts: Badge counter on icon + in-page notification for high-severity findings - 60+ Built-in Regex Patterns: AWS, Google, Stripe, Slack, Firebase, and more - Customizable Rules: Add, edit, or disable detection patterns via Options page - Privacy First: All scanning happens locally - no data sent to external servers - Domain Exclusions: Skip scanning on specific domains with regex patterns - Scan History: Local history with configurable auto-expiration 🎯 DETECTION CATEGORIES: ━━━━━━━━━━━━━━━━━━━━━━━ - AWS Access Keys & S3 Buckets - Google API Keys & OAuth Tokens - Stripe API Keys (Live & Restricted) - Slack Tokens & Webhooks - Firebase URLs - GitHub Tokens - RSA/PGP/SSH Private Keys - Bearer/Basic Auth Tokens - Sentry DSN - Discord Bot Tokens - Twilio, SendGrid, Mailgun API Keys - And 50+ more patterns 🛡️ PRIVACY COMMITMENT: ━━━━━━━━━━━━━━━━━━━━ PRISM does NOT: - Collect or transmit any user data - Use analytics or telemetry - Track browsing behavior - Make external network requests All scanning is performed 100% locally in your browser. ⚠️ DISCLAIMER: This tool is intended for security research and educational purposes. Always ensure you have proper authorization before scanning websites you don't own. 📖 Open Source: https://github.com/furkanumut/prism