What the JSON Formatter Leaks Taught Me About Browser-Side Tools

A formatter leak that should change how you pick tools

In late November 2025, security firm watchTowr published a disclosure about two of the most popular online JSON formatter sites — jsonformatter.org and codebeautify.org. Both offered a "Recent Links" feature that let users share formatted output with a teammate. The URLs were predictable, which meant the saved content was effectively reachable to anyone who guessed the URL pattern.

Per the watchTowr report, the result was over 80,000 saved snippets, totaling 5 GB+ of data, sitting on the public internet without authentication. The content that researchers were able to retrieve included:

• Active Directory credentials


• Cloud access keys (AWS / Azure / GCP)


• Private keys and CI/CD secrets


• JWTs from production systems


• AWS Secrets Manager exports

Based on the content of individual snippets, the data appeared to originate from a wide range of organizations — government, finance, healthcare, aerospace. Full disclosure: — a converter for JSON, YAML, CSV, Markdown, and HTML. The architecture choices are not novel; they just happen to make some of the questions above answerable:

• Next.js with output: "export" — pure static site, no server runtime


• All parsing in the browser (JSON.parse, js-yaml, papaparse, marked, turndown, remark)


• No /api/* routes in the project (you can grep )
  ❌
  ❌
  
  
  Same engine available as a CLI
  ✅ (npx formatarc)
  ❌
  ❌
  
  
  Multi-format (JSON + YAML + CSV + Markdown + HTML)
  ✅
  partial
  partial