Map what the browser can reach
Inspect the deployed JavaScript, network requests and public configuration. Separate keys intended for public clients from privileged credentials that must remain server-side.
A secret is not protected because a button or route is hidden in the interface.
- Search bundles for private key patterns
- List public API endpoints
- Inspect browser storage
- Remove privileged tokens and rotate exposed credentials
Test identity and authorization separately
Login answers who the user is. Authorization answers what that user may do. Create multiple roles and organizations, then test every sensitive request across those boundaries.
Never accept user, role, organization or subscription identity solely from editable browser state.
- Use two accounts in separate organizations
- Call admin routes as a normal user
- Change IDs in requests
- Test expired and revoked sessions
Review database and storage rules
Direct-client platforms such as Supabase and Firebase require policies that remain safe even when a user ignores your interface and calls the backend directly.
Test reads, writes, deletes, uploads and downloads while logged out and as the wrong account.
- Verify RLS or Firebase rules
- Protect ownership and role fields
- Test private file access
- Check server functions with elevated privileges
Exercise money and failure paths
Test duplicate requests, delayed webhooks, refunds, cancellation and stale pages. Then interrupt forms and workflows to confirm users can recover without corrupting state or repeating side effects.
Use AI tools to expand test cases, but have an experienced reviewer validate the conclusions.
- Replay important requests
- Deliver payment events twice
- Fail dependencies mid-flow
- Test loading, empty and error states
Authoritative references
Have experienced reviewers test the real application.
AuditFlare validates findings across your product, code and business logic, then explains what to fix.
Explore the AI-built app audit →