I built a security scanner for my pastebin. But detecting secrets is harder than I expected.

Description and use

A client‑side scanner was built for PasteDB to warn users about potential secrets before publishing a paste.

Problem

Accidental public exposure of API keys, database passwords, or access tokens in a paste-sharing application.

Outcome

The scanner now runs locally in the browser, detecting potential secrets before a paste is published and warning users, while avoiding sending paste content to external services.

Workflow

• 1. User types or pastes content into PasteDB editor.
• 2. Browser‑side scanner analyzes the content for known credential patterns.
• 3. Scanner checks for unusually random strings and evaluates surrounding context to assess sensitivity.
• 4. If potential secrets are detected, the scanner displays a warning to the user before the paste is created.
• 5. User can review the warning and decide whether to proceed or modify the content.

Evidence

I decided to build a security scanner that runs directly in the browser before a paste is created.

Source

The scanner is now working, and I’m continuing to improve it.

Source