# Phase 14: OSINT CI/CD Logs, Web Archives & Frontend Leaks - Context

**Gathered:** 2026-04-06
**Status:** Ready for planning
**Mode:** Auto-generated

<domain>
## Phase Boundary
Adds ReconSource implementations for CI/CD build log scraping (Travis CI, GitHub Actions, CircleCI, Jenkins), web archive searching (Wayback Machine, Common Crawl), and frontend asset analysis (JS bundles, source maps, env file leaks, Webpack/Next.js builds) to detect API keys leaked in build outputs, archived pages, and client-side code.
</domain>

<decisions>
## Implementation Decisions
### Claude's Discretion
All implementation choices are at Claude's discretion. Follow the established Phase 10 pattern: each source implements recon.ReconSource, uses pkg/recon/sources/httpclient.go for HTTP, uses httptest for tests. Each source goes in its own file.
</decisions>

<code_context>
## Existing Code Insights
### Reusable Assets
- pkg/recon/sources/ — established source implementation pattern from Phase 10
- pkg/recon/sources/httpclient.go — shared retry HTTP client
- pkg/recon/sources/register.go — RegisterAll (extend per phase)
- pkg/recon/source.go — ReconSource interface
</code_context>

<specifics>
## Specific Ideas
- TravisCISource — scrape public Travis CI build logs for leaked keys
- GitHubActionsSource — search GitHub Actions workflow logs for key exposure
- CircleCISource — scrape public CircleCI build logs
- JenkinsSource — scrape publicly accessible Jenkins build consoles
- WaybackMachineSource — search Wayback Machine snapshots for historical key leaks
- CommonCrawlSource — search Common Crawl index for pages containing keys
- JSBundleSource — analyze public JavaScript bundles for embedded API keys
- SourceMapSource — parse source maps to recover original source with keys
- EnvLeakSource — detect publicly accessible .env files on web servers
- WebpackSource — analyze Webpack chunk manifests for key exposure
- NextJSSource — analyze Next.js build artifacts for leaked server-side keys
</specifics>

<deferred>
## Deferred Ideas
None — straightforward source implementations.
</deferred>
