<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing API Key Exposure Testing

## gitleaks — Repository Secret Scanning
```bash
gitleaks detect --source=. --report-format=json --report-path=secrets.json
gitleaks detect --source=. --no-git  # Without git history
```

## trufflehog — Credential Scanner
```bash
trufflehog git file://. --json --only-verified
trufflehog filesystem --directory=src/ --json
```

## curl — Endpoint Probing
```bash
# Check config endpoints
curl -s https://target.com/api/config | jq .
curl -s https://target.com/.env
curl -s https://target.com/actuator/env | jq .
```

## jsluice — JavaScript Secret Extraction
```bash
jsluice secrets https://target.com/app.js
jsluice urls -R https://target.com/app.js
```

## nuclei — Token Exposure Templates
```bash
nuclei -u https://target.com -t http/exposures/tokens/ -json
```
