---
description: 'Repeatable external black-box audit workflow for SPAs: infrastructure
  baseline → endpoint fuzzing → JS bundle extraction → API probing → RLS verification
  → active attack testing. Outputs severity-bucketed findings with a three-horizon
  remediation roadmap.'
kind: procedure
name: web-security-audit-methodology
---


## Trigger
Use when performing an external black-box security audit of a SPA-backed web application.

## Pre-conditions / Inputs
- Target domain(s) and any known sub-domains
- `curl`, browser DevTools, `jq` available
- No authenticated access required (black-box)

## Steps

1. **Baseline infrastructure scan** — check HTTP response codes, security headers (`HSTS`, `CSP`, `X-Frame-Options`, `X-Content-Type-Options`), and CDN/WAF fingerprints.
2. **Endpoint fuzzing** — probe common admin, debug, and API paths (`/admin`, `/debug`, `/api/v*`, etc.); record which return non-404 responses.
3. **JS bundle extraction** — download the main bundle (Vite/webpack); grep for secrets (`eyJ`, `key`, `token`, `password`), internal URLs, and API route strings. See [[digest/wiki/supabase-spa-bundle-exposure.md]] for the React/Vite-specific risk.
4. **API endpoint probing** — hit every discovered route with `GET`/`POST`; map gateway errors vs. real 401/403 vs. data responses.
5. **Database RLS verification** — if a Supabase anon key is found, query known table names via REST; confirm empty-array vs. data leak.
6. **Active attack vector testing** — test path traversal (`%2e%2e/`), CORS bypass (`Origin: https://evil.com`), header injection, and rate-limit absence (burst 5+ rapid requests).

## Output
- Findings bucketed by severity: Critical / High / Medium / Low (CVSS where applicable)
- Three-horizon remediation roadmap: immediate ≤24 h, urgent ≤1 week, short-term ≤1 month
- Report delivered as both PDF and Markdown

## Failure Modes / Caveats
- WAF (e.g. Cloudflare) may block traversal tests; note blocks as positive controls, not gaps.
- Missing CORS response headers may be an intentional whitelist — distinguish misconfiguration from policy.
- Anon key exposure severity is gated on RLS posture; always test both dimensions before scoring.
- Black-box scope may miss authenticated-path vulnerabilities; flag for follow-on authenticated audit.

derived_from:: [[memory/2026-07-26/sumopod-security-audit-findings.md]]
relates_to:: [[digest/wiki/supabase-spa-bundle-exposure.md]]