<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# JavaScript Detection Templates — API Reference

## Nuclei JS Detection Scanning Options

```bash
# Scan for JS secrets
nuclei -u https://target.com -t js-secrets.yaml -json

# Scan with tag filter
nuclei -u https://target.com -tags js,secrets -json

# Bulk target scan
nuclei -l targets.txt -t js-templates/ -json -o results.json
```

## Common API Key Regex Patterns

| Provider | Pattern |
|----------|---------|
| AWS Access Key | `AKIA[0-9A-Z]{16}` |
| OpenAI | `sk-[a-zA-Z0-9]{20,}` |
| GitHub PAT | `ghp_[a-zA-Z0-9]{36}` |
| Slack Token | `xox[boaprs]-[a-zA-Z0-9-]+` |
| Google API | `AIza[0-9A-Za-z_-]{35}` |
| Stripe Secret | `sk_live_[a-zA-Z0-9]{24,}` |
| Twilio | `SK[0-9a-fA-F]{32}` |

## Source Map Detection Indicators

| Field | Description |
|-------|-------------|
| `sources` | Array of original source file paths |
| `mappings` | Base64 VLQ encoded source mappings |
| `sourcesContent` | Original source code (if included) |
| `file` | Generated file name |
| `sourceRoot` | Base path for source files |

## JavaScript Bundle Paths

| Path Pattern | Framework |
|--------------|-----------|
| `/static/js/main.*.js` | Create React App |
| `/assets/*.js` | Vite |
| `/_next/static/chunks/*.js` | Next.js |
| `/build/static/js/*.js` | React production |
| `/dist/*.js` | Generic webpack |

## Response Matchers for JS Analysis

| Technique | Matcher Type | Purpose |
|-----------|-------------|---------|
| Key detection | `regex` | Match provider-specific key formats |
| Library version | `regex` with `group` | Extract semver from source |
| Source map | `word` | Confirm JSON structure fields |
| Dev artifacts | `word` | Match config/debug keywords |
