Scan webpages for exposed secrets using LLM
Fetches a webpage and uses an LLM to identify and extract inadvertently exposed API keys or credentials as a structured JSON array.
Setup
- → Install curl
- → Install jq
- → Install Simon Willison's llm CLI (pip install llm)
- → Configure LLM API key (llm keys set openai)
Cost per run
Minimal LLM API costs per page scanned (e.g., ~$0.001 with gpt-4o-mini).
The one-liner
$ curl -sL https://targeting.ai | llm -s "Scan this text for exposed API keys, passwords, or secrets. Return ONLY valid JSON with a 'secrets' array containing objects with 'type' and 'snippet'. If none, return empty array." | jq '.secrets'What each stage does
- [01] curl
curl -sL https://targeting.aiFetches the target webpage silently (-s) and follows any HTTP redirects (-L). - [02] llm
llm -s "Scan this text..."Pipes the raw HTML into the LLM, using a system prompt (-s) to enforce strict JSON output containing any discovered credentials. - [03] jq
jq '.secrets'Parses the LLM's JSON response to isolate the 'secrets' array, making it easy to integrate into larger security automation scripts.
Expected output (sample)
[
{
"type": "AWS Access Key",
"snippet": "AKIAIOSFODNN7EXAMPLE"
}
]Caveats & tips
- Footgun: Sending large, minified HTML bundles might exceed the LLM's context window or cause the model to hallucinate false positives.
- Privacy/Permission: You are sending potentially sensitive scraped data to a third-party LLM provider. Ensure you have permission to scan the target and check the provider's data retention policy.