# JavaScript Security Analyzer — Offline Code Security / DevSecOps Tool

[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
[![Python 3.12+](https://img.shields.io/badge/python-3.12+-blue.svg)](https://www.python.org/downloads/)
[![Offline](https://img.shields.io/badge/mode-offline%20first-important.svg)](#)
[![secintel](https://img.shields.io/badge/schema-secintel%20v1-purple.svg)](https://github.com/reshot2005/secintel-core)
[![GitHub](https://img.shields.io/badge/github-reshot2005%2Fjavascript-security-analyzer-black.svg)](https://github.com/reshot2005/javascript-security-analyzer)

> **JavaScript/TypeScript SAST for eval, innerHTML, prototype pollution, and secrets — offline JS code security scanner.**

**Category:** Code Security / DevSecOps  
**Collection phase tool:** 2/10  
**Schema:** [secintel-core](https://github.com/reshot2005/secintel-core) v1  
**Repository:** https://github.com/reshot2005/javascript-security-analyzer  
**Author account:** [reshot2005](https://github.com/reshot2005)

## Why JavaScript Security Analyzer ranks for security search

JavaScript Security Analyzer is an **offline-first**, research-grade **code security / devsecops** utility designed for practitioners who need reproducible analysis without uploading sensitive artifacts to SaaS scanners. It emits structured findings through the shared **secintel** evidence taxonomy (OBSERVED / DERIVED / INFERRED / CORRELATED / VERIFIED) so results are auditable, exportable, and CI-friendly.

### Primary SEO keywords
`JavaScript SAST, XSS sink detection, prototype pollution, JS secrets scanner, TypeScript security`

### Topics
`devsecops` `application-security` `sast` `secure-coding` `cybersecurity` `code-security` `sbom` `security-tools` `python` `offline-security` `javascript-security` `xss`

## What problem does this solve?

Scan JavaScript/TypeScript for XSS sinks, eval usage, prototype pollution risks, and embedded secrets offline.

Targeted JS risk patterns with offline reproducibility.

## Key features

- JS/TS static checks

• innerHTML/eval detection

• Prototype pollution signals

• Secret pattern hits

• SARIF/JSON export

  Ideal use cases

  • Frontend security reviews

• Node service audits

• Bug bounty code recon

  Who should use this

  • Security engineers & AppSec / NetSec specialists
  • SOC / DFIR / malware analysts (as applicable)
  • Bug bounty hunters and penetration testers
  • DevSecOps teams needing offline/air-gapped tooling
  • Students and researchers learning code security / devsecops

  Quick start

  git clone https://github.com/reshot2005/javascript-security-analyzer.git
  cd javascript-security-analyzer
  python3.12 -m venv .venv
  source .venv/bin/activate  # Windows: .venv\Scripts\Activate.ps1
  pip install -e ../secintel-core  # or: pip install -e git+https://github.com/reshot2005/secintel-core.git#egg=secintel-core
  pip install -e ".[dev]"
  
  javascript-security-analyzer analyze sample_data --json
  javascript-security-analyzer analyze sample_data --html report.html
  javascript-security-analyzer version

  Exports for interoperability

  javascript-security-analyzer analyze sample_data \
    --json --html report.html --csv findings.csv --sarif results.sarif

  Evidence quality & reproducibility

  • Findings follow secintel classification rules (confidence only where schema allows).
  • Provenance includes tool version, config hash, and input integrity metadata.
  • Set SECINTEL_SOURCE_DATE_EPOCH for deterministic timestamps in CI.

  export SECINTEL_SOURCE_DATE_EPOCH=1704067200
  javascript-security-analyzer analyze sample_data --json

  Development

  ruff check src tests
  mypy src
  pytest

  Related tools in this collection

  Browse more offline security research tools by reshot2005: network security, web AppSec, DevSecOps, digital forensics, and static malware analysis — each in its own public repository with the same secintel reporting contract.

  License

  MIT — free for research, education, and commercial use with attribution preserved.

  ---

  Discoverability blurb (search engines & GitHub)

  JavaScript Security Analyzer (javascript-security-analyzer) — JavaScript/TypeScript SAST for eval, innerHTML, prototype pollution, and secrets — offline JS code security scanner. Search terms: JavaScript SAST, XSS sink detection, prototype pollution, JS secrets scanner, TypeScript security. Open-source, MIT-licensed, Python 3.12, offline cybersecurity tool by reshot2005.