A bug bounty researcher found Azure credentials in a JavaScript file and called it done. I kept going — four Azure AD credentials sitting in a public JS file, enough to authenticate as the application itself. The frontend had documented its own backend. Full account takeover. The application's token had been granted the ability to perform user-level operations — every account in the system was reachable. The organization had GitLeaks in CI/CD and static secret scanning on pull requests. The credentials were still live.

That was one chain. A second application used CryptoJS to encrypt its configuration — a common pattern in SPAs where developers believe encrypting the config protects it. The decryption key was hardcoded in the same JavaScript file, three lines away from the encrypted blob. The secret to unlock everything was sitting next to the lock. Same credential pattern at the end. Same result.

Shift-left tools scan what you commit. They do not scan what you serve. Build-time environment injection bakes live keys into webpack bundles that never touch the repository. CI/CD pipeline variable substitution materializes secrets only in the build artifact, after every scanner has run. SSR state blobs injected by Next.js and Nuxt carry credentials into HTML that no pre-deployment scanner ever sees. Once a secret reaches production, it disappears from every scanner's view. The only things finding runtime secrets are manual penetration testers, bug bounty researchers, and attackers. Two of those three report what they find.

This talk walks through both exploitation chains in detail, maps the full shift-right gap in the security tooling landscape, and closes with a live demo using a purpose-built intentionally vulnerable healthcare portal — a HIPAA-branded application exposing Twilio, SendGrid, Stripe, and Firebase credentials in its public JavaScript files, and leaking internal service keys in response headers on every single request.

The demo uses SecretSifter — a free Burp extension, browser tool, and desktop app built for the runtime layer — to find every secret passively, without configuration, as traffic flows.

Attendees leave with a clear mental model of where shift-left controls stop, hands-on understanding of the runtime attack surface, and a free tool they can run against a target the same day.