When I was building jsonwebtools.com, I decided the security scanner had to run entirely in the browser — no API calls, no logging, no server.

Here’s how I built it.

Why a JSON Security Scanner?

Developers paste JSON everywhere — API responses, config files, database exports.

That JSON often contains things it shouldn’t:

• Hardcoded API keys and passwords

• User PII (emails, phone numbers, SSNs)

• XSS payloads injected into user data

• SQL injection strings hiding in values

• Internal file paths and system info

None of the existing JSON tools checked for this. So I built one.

How It Works

The scanner recursively walks the entire JSON tree and runs each value through a set of detection patterns.

function scanJSON(obj, path = '') {
  if (typeof obj === 'string') {
    return runPatterns(obj, path);
  }

  if (Array.isArray(obj)) {
    return obj.flatMap((item, i) =>
      scanJSON(item, `\({path}[\){i}]`)
    );
  }

  if (typeof obj === 'object' && obj !== null) {
    return Object.entries(obj).flatMap(([key, val]) =>
      scanJSON(val, path ? `\({path}.\){key}` : key)
    );
  }

  return [];
}

For each string value, it runs pattern matching against known threat signatures.

Detection Patterns

XSS Detection

const xssPatterns = [
  /<script[\s\S]*?>[\s\S]*?<\/script>/gi,
  /javascript\s*:/gi,
  /on\w+\s*=\s*["'][^"']*["']/gi, // onerror=, onclick=, etc.
  /<iframe[\s\S]*?>/gi,
  /eval\s*\(/gi,
  /document\.(cookie|write|location)/gi
];

SQL Injection Detection

const sqlPatterns = [
  /(\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|ALTER)\b.*\b(FROM|INTO|WHERE|TABLE)\b)/gi,
  /'\s*(OR|AND)\s*'?\d+\s*'?\s*=\s*'?\d+/gi, // ' OR 1=1
  /;\s*(DROP|DELETE|INSERT|UPDATE)\s/gi,
  /--\s*$/gm, // SQL comment
  /\/\*[\s\S]*?\*\//g // block comment
];

PII Detection

const piiPatterns = [
  { pattern: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, type: 'Email' },
  { pattern: /\b\d{3}[-.]?\d{3}[-.]?\d{4}\b/g, type: 'Phone number' },
  { pattern: /\b\d{3}-\d{2}-\d{4}\b/g, type: 'SSN' },
  { pattern: /\b4[0-9]{12}(?:[0-9]{3})?\b/g, type: 'Visa card' },
  { pattern: /\b5[1-5][0-9]{14}\b/g, type: 'Mastercard' }
];

Credential Detection

const credentialPatterns = [
  /["']?(api[_-]?key|apikey|api[_-]?secret)["']?\s*[:=]\s*["']([^"']{8,})["']/gi,
  /["']?(password|passwd|pwd)["']?\s*[:=]\s*["']([^"']{4,})["']/gi,
  /["']?(secret|token|auth)["']?\s*[:=]\s*["']([^"']{8,})["']/gi,
  /bearer\s+[a-zA-Z0-9\-._~+/]+=*/gi,
  /ghp_[a-zA-Z0-9]{36}/g, // GitHub personal access token
  /sk-[a-zA-Z0-9]{48}/g   // OpenAI API key
];

Severity Classification

Each finding gets a severity level:

function classifySeverity(finding) {
  if (finding.type === 'XSS' || finding.type === 'SQL Injection') {
    return 'HIGH';
  }

  if (finding.type === 'API Key' || finding.type === 'Password') {
    return 'HIGH';
  }

  if (finding.type === 'SSN' || finding.type === 'Credit Card') {
    return 'MEDIUM';
  }

  if (finding.type === 'Email' || finding.type === 'Phone') {
    return 'LOW';
  }
}

Path Tracking

Every finding includes the full JSON path so you know exactly where the issue is:

• HIGH: XSS pattern detected at users[2].bio

• MEDIUM: Email address found at orders[0].customer.email

• HIGH: API key detected at config.integrations.stripe.secret

Performance Considerations

For large JSON files (1MB+), the recursive scan can be slow.

I added:

• A debounce so it only runs after the user stops typing

• A size check to warn about files over 500KB before scanning

const debouncedScan = debounce((json) => {
  const parsed = JSON.parse(json);
  const findings = scanJSON(parsed);
  displayFindings(findings);
}, 500);

What I Found While Testing

While building the scanner, I ran it on my own test fixtures and found:

• A forgotten Stripe test key in a mock API response

• Email addresses in a dataset I thought was anonymized

• A password: "admin123" in a config template

The scanner paid for itself before launch.

False Positives

Regex-based detection isn’t perfect.

• Email pattern triggers on test@example.com

• Phone pattern triggers on version numbers like 123.456.7890

• SQL pattern can trigger on legitimate strings containing SELECT or WHERE

I consider these acceptable false positives — better to flag and let the developer decide than to miss a real credential.

Future improvement: add a whitelist/ignore system for known-safe patterns.

Try It

The scanner runs automatically on every JSON validation at jsonwebtools.com — paste any JSON and it scans immediately.

No account. No server. No data logging.

The full platform includes 68+ tools: JWT decoder, JSON → TypeScript/Go/Rust/Python/C#, diff tool, batch validator, performance benchmarking, and more.