Deep JS Discovery Engine:
Probes page HTML and cached JS files to extract dynamic imports, chunk maps, and Webpack/Vite build manifests (e.g., Next.js _buildManifest.js).
Scans common framework directories (/static/js/, /assets/, etc.) and common file structures to discover hidden scripts.
Built-in rate-limiting and safety controls: max 5 concurrent requests, 150ms batch delay, 8-second request timeouts, and a hard cap of 500 requests per run.
Supports secondary HTML scans (1-level deep) for script endpoints found during exploration.
Real-Time Security & Key Scanner (scanner.js):
Automated matching of JS content against targeted rules: API/client keys, JWT tokens, private keys, GitHub/Stripe/Slack tokens, Supabase/Firebase configs, environment variables, internal IPs, and cloud storage paths.
Extracts developer comments (excluding standard noise like eslint-disable) and API endpoints (GraphQL, WebSockets, MQTT).
Automated Source Map Acquisition:
Automatically resolves and downloads .map source files referencing sourceMappingURL in scanned assets.
Intelligent Domain Matching (eTLD+1):
Smart base domain extraction that handles two-part TLDs (e.g., co.uk, com.au) to map out sibling subdomains, CDNs, and parent domains.
Modern Dark Mode Popup UI:
Sleek multi-tab layout (Capture, Discover, Findings, Export) with live probing statistics.
Expandable finding cards with copy-to-clipboard actions and scan dismissal.
Structured Export & Storage:
Saves state to browser local storage.
Option to download complete session state as a JSON payload, including subdomains and endpoints wordlists.
Organizes local file downloads under a clean JS_Scraper/ directory structure, generating a companion *_findings.txt summary report for each script containing hits.