Leaked token in URL, JS, or Referer
Tokens in query strings, hash fragments that get sent to third parties, JWTs in localStorage readable by XSS, API keys in mobile APKs and JS bundles.
Tags: token, ato, oauth, secrets
Typical severity: P2-P4
What it becomes
A password-reset or OAuth token in a URL is an ATO gadget if it is reusable, long-lived, or logged.
Where to look
reset linksmagic linksOAuth redirectsSentry / Datadog / analyticsserver logs of full URLs
Chains
- ATO — Open redirect or XSS on a page that receives the token, or Referer leak to an attacker-controlled image.
- API takeover — Bearer token in a JS bundle or HAR used against the live API.
Notes
- Firebase apiKey is expected to be public. The gadget is an open signup + security-rules miss, not the key.
- Check whether the token is one-time and bound to the user-agent or IP before you call it ATO.