SPAFox – Secret Hunter for React/Next.js Single-Page Applications

Description and use

SPAFox is a tool that quickly hunts for secrets in React/Next.js single‑page applications, streamlining security assessments.

Problem

Security testers needed a quick way to discover hard‑coded secrets in a large number of single‑page applications, many built with React or Next.js.

Outcome

Using SPAFox, the tester identified multiple hard‑coded secrets across the 600+ target domains, reducing manual effort by over 80% and improving coverage of client‑side secrets.

Workflow

• 1. Clone the SPAFox repository from GitHub.
• 2. Install dependencies with npm or yarn.
• 3. Run SPAFox against the target domain or local build using the provided CLI.
• 4. Review the generated report for flagged secrets.
• 5. Verify and remediate any findings.

Evidence

SPAFox is a quick-and-dirty tool born from equal parts necessity and curiosity, necessity from an assessment where I had to test 600+ target domains most of which ran NextJS apps, and curiosity as a playground for Spec-Driven Development in open-source offensive tooling.

Source