Skip to main content
The Jsmon Firefox Extension — also known as the Jsmon Security Analyzer — automatically captures and analyzes web traffic directly from your browser. It sends matched files to Jsmon’s External Attack Surface Management (EASM) engine for analysis, without requiring manual uploads or proxies. Install from Firefox Add-ons

​
How It Works

  1. Install the extension from Firefox Add-ons.
  2. Open the extension and enter your Jsmon API key to authenticate with your account.
  3. Browse normally — the extension passively captures traffic in the background.
  4. Matched file types are forwarded to Jsmon’s scanning engine for analysis.
  5. Findings appear in your Jsmon dashboard showing secrets, APIs, risks, and asset inventory.
You need a Jsmon API key to use this extension. Generate one from Settings → API in the Jsmon web app.

​
What It Detects

  • Exposed Secrets — API keys, tokens, and credentials in JavaScript or configuration files
  • Shadow APIs — Undocumented endpoints in frontend code
  • Supply Chain Risks — Vulnerable or suspicious NPM packages
  • Sensitive Data Exposure — PII, internal paths, environment variables
  • Misconfigured Assets — Insecure headers, open redirects, debug artifacts

​
Supported File Types

The extension analyzes 20+ file formats including: JavaScript, JSX, TypeScript, HTML, PHP, ASPX, YAML, JSON, XML, environment files, and others.

​
Who It’s For

  • Security engineers conducting reconnaissance or penetration testing
  • AppSec and EASM teams monitoring external attack surfaces
  • Bug bounty hunters accelerating JavaScript reconnaissance
  • CISOs and compliance teams requiring continuous visibility

​
Permissions

The extension requires:
  • Access to browser tabs
  • Access to your data for all websites

​
Details