Fetched public assets
The web workflow inspects supported HTML, JavaScript, JSON, manifest, and related text assets reached from the target URL.
Web and client-side exposure
Validate what your frontend exposes before customers—or attackers—find it.
SecOpsium fetches supported public application assets and reviews client-side JavaScript and configuration signals that may deserve restriction, rotation, or architecture review.
Definition
What this capability validates
Web exposure validation distinguishes intentionally public identifiers, public but restricted keys, sensitive credentials, and unknown values that require review. A visible value is not automatically a vulnerability.
Current capability
Context-aware classification
Known public identifiers, restricted keys, sensitive patterns, and ambiguous values are not treated as identical evidence.
Exposure-aware priority
Public reachability contributes context, while supported impact and uncertainty remain separately visible.
Revalidation after changes
A later web validation can show whether the same exposed value still appears in fetched assets.
Scope and Limits
- Some client-side identifiers are intentionally public and require provider-specific restrictions rather than removal.
- The scan covers fetched supported assets, not every route, authenticated surface, or runtime state.
- Unknown values require human review.
Frequently Asked Questions
Are all frontend keys security vulnerabilities?
No. Some identifiers are public by design. Risk depends on scope, restrictions, provider behavior, and what the value can access.
Does the web validation crawl every application route?
No. It evaluates supported assets fetched from the supplied target and discovered references; coverage is not a complete dynamic application test.
How is an ambiguous value handled?
It remains marked for review rather than being converted into false certainty.