Auditing Client-Side JWT Claims, LocalStorage Secret Leaks, and B2B SaaS Pricing Page Architectures in Manifest V3

#security #webdev #javascript #saas

When auditing a modern B2B SaaS web application—whether you are benchmarking a competitor's pricing/checkout flow or verifying your own multi-tenant authentication boundaries before a SOC 2 pen-test—two client-side surfaces reveal the most architectural detail:

The Pricing & Checkout DOM: How the application structures its billing engine (Stripe Billing, Paddle MoR, Lemon Squeezy, Chargebee, Orb), decoy anchor tiers, annual discount framing, and usage-based sliders.
Client-Side Web Storage (localStorage & sessionStorage): Unencrypted Base64URL JWT payloads (eyJ...) containing tenant roles, feature flags, and expiration windows, alongside accidentally persisted API keys (sk-, ghp_, xoxb-) left behind by client-side SDKs.

Here is a 5-row teaser from our 150 B2B SaaS Pricing Page Architecture Benchmark, followed by a clean Manifest V3 snippet for auditing client-side JWT claims and accidental secret leaks in real time.

1. Teaser: 5 B2B SaaS Pricing Page & Billing Engine Architectures (From Our 150-Row Dataset)

Across 150 top B2B SaaS products, high-converting pricing pages combine a predictable seat or usage metric with a decoy middle/pro anchor and a 17%–25% annual commitment discount:

Company	Category	Billing Engine	Primary Value Metric	Free Tier / Trial Model	Annual Discount Framing	Decoy / Anchor Architecture
Linear	DevTools	Stripe Billing	Active Users	Free forever up to 250 active issues	20% off ("2 months free" toggle default-checked)	Standard ($8/user) vs. Plus ($14/user) highlighted with SSO & SAML
PostHog	Product Analytics	Stripe + Custom Metering	Monthly Events / Replays	Generous monthly free allowance (1M events)	Usage-based tiered volume discounts	Interactive log-scale event slider with instant unit-cost breakdown
Resend	Email API	Stripe Billing	Monthly Emails Sent	3,000 emails/mo (100/day cap)	20% off on Pro ($20/mo) and Scale ($90/mo)	Daily rate-limit cap on Free forces immediate upgrade to Pro ($20) for production apps
Supabase	Backend / DB	Stripe Billing	Compute Instance + Active MAUs	2 free projects (paused after 7 days inactivity)	Predictable $25/mo Pro base + compute add-ons	7-day inactivity pause on Free acts as the primary B2B conversion gate
Raycast	Productivity / AI	Stripe Billing	Per User + AI Model Tier	Free core launcher forever	20% off ($8/mo billed annually vs. $10/mo)	Advanced AI models (Claude Sonnet / GPT-4o) gated as an $8/mo add-on

(The full 150-row CSV dataset is bundled inside **StripeRay* below, alongside the live DOM pricing & checkout extractor extension).*

2. Client-Side JWT Claims Decoding & Storage Secret Leak Auditing in Manifest V3

During multi-tenant QA testing, digging through Application -> Local Storage in Chrome DevTools and manually pasting tokens into jwt.io is both slow and risky (if developers paste production session tokens into third-party websites).

With a 100% local Manifest V3 content script, you can scan window.localStorage and window.sessionStorage, decode Base64URL JWT payloads in memory, flag expired tokens, and check for high-entropy secret prefixes without a single byte leaving the browser:

// Manifest V3 LocalStorage JWT Claims Decoder & Secret Leak Auditor (Teaser Snippet)
export function auditClientStorageSecurity() {
  const JWT_REGEX = /^eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
  const SECRET_PATTERNS = [
    { type: 'OpenAI / Stripe Secret Key', regex: /\b(sk-[a-zA-Z0-9]{20,}|sk_live_[a-zA-Z0-9]{20,})\b/ },
    { type: 'GitHub PAT', regex: /\b(ghp_[a-zA-Z0-9]{30,}|github_pat_[a-zA-Z0-9_]{30,})\b/ },
    { type: 'Slack Bot/User Token', regex: /\b(xox[baprs]-[a-zA-Z0-9-]{15,})\b/ }
  ];

  const decodeBase64UrlJson = (segment) => {
    try {
      const base64 = segment.replace(/-/g, '+').replace(/_/g, '/');
      const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');
      return JSON.parse(decodeURIComponent(escape(window.atob(padded))));
    } catch {
      return null;
    }
  };

  const findings = { jwts: [], secretLeaks: [] };

  for (const [storeName, storage] of [['localStorage', window.localStorage], ['sessionStorage', window.sessionStorage]]) {
    for (let i = 0; i < storage.length; i++) {
      const key = storage.key(i);
      const rawValue = storage.getItem(key) || '';

      // 1. Check for raw or JSON-nested JWTs
      const candidateTokens = rawValue.match(/eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g) || [];
      for (const token of candidateTokens) {
        if (!JWT_REGEX.test(token)) continue;
        const [headerSeg, payloadSeg] = token.split('.');
        const claims = decodeBase64UrlJson(payloadSeg);
        if (claims) {
          const isExpired = claims.exp ? (claims.exp * 1000 < Date.now()) : false;
          findings.jwts.push({ storeName, key, header: decodeBase64UrlJson(headerSeg), claims, isExpired });
        }
      }

      // 2. Audit for accidental plaintext secret keys in browser storage
      for (const rule of SECRET_PATTERNS) {
        if (rule.regex.test(rawValue)) {
          findings.secretLeaks.push({ storeName, key, secretType: rule.type });
        }
      }
    }
  }
  return findings;
}

Get the Complete Manifest V3 Chrome Extensions & Engineering Kits

All of our Chrome extensions run 100% locally in your browser (Load Unpacked ready in chrome://extensions) and include full unminified source code (use code STACKOPS20 on Payhip for 20% off):

#51 — StripeRay: SaaS Pricing Page, Billing Engine & Anchoring X-Ray Chrome Extension (MV3) + 150 Pricing Teardowns CSV ($24)
Detect payment processors and billing engines (Stripe, Paddle, Lemon Squeezy, Chargebee, Orb), extract price tiers and annual discount anchors from the live DOM, and get the full 150-row B2B SaaS Pricing Page Benchmark CSV.
- Payhip ($24): https://payhip.com/b/Hl6LB
- Ko-fi Shop ($24): https://ko-fi.com/s/0ecc44685d
#52 — StorageX: Live JWT Claims Decoder, LocalStorage Secret Leak Auditor & Multi-Tenant Session Snapshotter ($24)
Automatically decode JWT claims (exp, sub, org_id, role, scope) across localStorage and sessionStorage, audit for leaked API keys, and export multi-tenant session JSON snapshots in one click.
- Payhip ($24): https://payhip.com/b/IueNt
- Ko-fi Shop ($24): https://ko-fi.com/s/bad62fb7d9
#50 — The Complete 8-in-1 Chrome Extension & Anti-Slop Developer Suite ($39 — $205+ Value)
Master bundle of our MV3 Chrome Extensions + the MV3 License Key Monetization Boilerplate + the 12 Anti-AI-Slop UI Design Systems Pack:
- Payhip ($39): https://payhip.com/b/KJ4VD
- Ko-fi Shop ($39): https://ko-fi.com/s/5307bc654b
More Standalone MV3 Chrome Extensions & Kits (#41–#49)
- #48 Chrome Extension Monetization & Shadow-DOM Boilerplate Kit ($29): Payhip | Ko-fi Shop
- #49 MailGuard: Cold Email Spam-Trigger & Live MX/DMARC Scorer ($24): Payhip | Ko-fi Shop
- #46 SubKill: SaaS Trial-Trap, Zombie Seat & Retention Discount Detector ($24): Payhip | Ko-fi Shop
- #47 RestGuard: Local API Request Interceptor & Mock Override ($19): Payhip | Ko-fi Shop
- #44 Anti-AI-Slop 12 UI Design Systems Pack (.cursorrules + CLAUDE.md) ($24): Payhip | Ko-fi Shop
- #45 PromptDock: AI Prompt Vault & Chat-to-Markdown Exporter ($19): Payhip | Ko-fi Shop
- #41 StackRay: B2B Lead, Tech-Stack & Live DNS/MX X-Ray ($24): Payhip | Ko-fi Shop
- #42 StealThisUI: Website Design System to Cursor/Claude Prompt ($19): Payhip | Ko-fi Shop
- #43 CiteCheck: Technical SEO, JSON-LD & /llms.txt Auditor ($19): Payhip | Ko-fi Shop
- Flagship All-Access Engineering, Security & FinOps Vault ($49): Payhip | Ko-fi Shop

DEV Community

Auditing Client-Side JWT Claims, LocalStorage Secret Leaks, and B2B SaaS Pricing Page Architectures in Manifest V3

1. Teaser: 5 B2B SaaS Pricing Page & Billing Engine Architectures (From Our 150-Row Dataset)

2. Client-Side JWT Claims Decoding & Storage Secret Leak Auditing in Manifest V3

Get the Complete Manifest V3 Chrome Extensions & Engineering Kits

Top comments (0)