一句话：提出 SwS，用多提示 LLM 工作流在还原的生产 JavaScript 中检出无固定格式、由使用逻辑定义的密钥泄露。
传统密钥扫描器只能识别具有已知格式的值，但某些值仅因使用方式而变得敏感，例如用于非标准认证头的随机字符串。本文研究如何用 LLM 工作流在 js-recon 还原的 JavaScript 中发现这类“逻辑定义型”泄露。SwS 采用四个按类别定制的提示，并由一个协调器交叉比对各提示输出，配合共享模式、定性分诊与作用域校验的验证流程。作者在 1,500 个还原的生产目标上评估：SwS 提出 303 个逻辑定义型候选，其中 40 个符合验证条件，最终端到端验证出 5 个可实际利用的在线泄露，包括一个在生产 JavaScript 中暴露、并经独立可复现的离线伪造所确认的客户端断言签名绕过；而基于格式的基线工具 TruffleHog 未能匹配到任何一个。
Secret scanners recognize values with known formats, but a value may become sensitive only through its use. A random string used in a non-standard header for authentication is one example. We examine an LLM workflow for finding such logic-defined exposures in JavaScript recovered by js-recon. SwS uses four class-specific prompts and a coordinator that cross-references their outputs, a shared schema, qualitative triage, and scope-checked verification. Evaluated over 1,500 recovered production targets, SwS proposed 303 logic-defined candidates, 40 verification-eligible, and five verified end-to-end as live, exploitable exposures - including a client-assertion signing bypass surfaced in production JavaScript and confirmed by an independently reproducible offline forgery - while TruffleHog, a format-based baseline, matched none.