Keys on Doormats: Exposed API Credentials on the Web

arXiv:2603.12498 · cs.CR, cs.CY, cs.HC, cs.NI · Submitted 2026-03-12 · Read on arXiv

cs.CR, cs.CY, cs.HC, cs.NI

Submitted: 2026-03-12

Updated: 2026-09-14

Journal ref: 2026 ACM SIGSAC Conference on Computer and Communications Security (CCS '26)

DOI: 10.1145/3830454.3846651

Code: https://github.com/HTTPArchive/wappalyzer

Project page: https://www.bar.com/test.html

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

Verification — 10× in this paper · explained in 2 episodes
Application Programming Interface — 3× in this paper
Core — 3× in this paper · explained in 2 episodes
IEEE Symposium on Security and Privacy — 2× in this paper
Actor — 1× in this paper · explained in 3 episodes
Decode — 1× in this paper · explained in 2 episodes
Open Web Application Security Project — 1× in this paper
Redundancy — 1× in this paper · explained in 2 episodes
Trace — 1× in this paper · explained in 2 episodes

Sources

Related papers