JavaScript review
Treat the frontend as source. Most P1s on modern apps start here.
Tags: js, recon, xss, secrets
Checklist
- Collect every JS URL — katana -jc, getJS, HTML script src, prefetch, service worker, web workers, JSONP leftovers.
- Grab source maps — sourceMappingURL, same-path .map, _next/static. Restore original files before grepping.
- Index routes and verbs — Fetch paths, axios bases, GraphQL operations, websocket URLs, feature flags.
- Find sinks — innerHTML, html(), v-html, dangerouslySetInnerHTML, document.write, eval, new Function, location, postMessage, window.open.
- Find sources — location, document.referrer, postMessage, storage, URLSearchParams, cookie, window.name.
- Find secrets and tenants — AKIA, Firebase, Stripe, Mapbox, Datadog, environmentKey, appDefinition, client IDs, audience, tenant slugs.
- Find authz assumptions — isAdmin, role, tenantId, organisationId in client state. Anything the UI hides is still an API param.
- postMessage map — Every addEventListener('message') and every postMessage(*, '*'). Origin checks and sinks.