I tested my security extension against 20 real sites and found three bugs - in my own tool

#showdev #webdev #security #javascript

I built 'QuickAudit', a browser extension that runs ten OWASP-style security checks on whatever web page you're currently viewing (headers, cookie flags, mixed content, vulnerable JS libraries via OSV.dev, exposed files).

Before publishing, I pointed it at a corpus of 20 real-world websites- ten major security vendor sites and ten older enterprise properties - expecting a quick validation exercise to confirm everything worked.

Instead, it turned into a bug hunt. And the bugs were all mine.

Here are the three biggest false-positive traps I uncovered in my own code, and how testing against a live corpus changed the architecture.

Bug 1: I was auditing Cloudflare's challenge page and calling it your website

During the corpus test, QuickAudit reported 'sourceforge.net' as missing HTTP Strict Transport Security (HSTS).

Surprised, I opened terminal and ran 'curl -I https://sourceforge.net'. The header was right there: 'strict-transport-security: max-age=31536000; includeSubDomains; preload'.

Why was my extension flagging it?

It turned out my automated scan had been served a Cloudflare bot-protection interstitial page in 44ms. The extension was faithfully auditing the challenge page’s headers, not Sourceforge's actual production application.

The Lesson: Any security tool that programmatically fetches a URL rather than inspecting a real, fully completed browser navigation inherits this bug — and it fails toward confident wrongness, which is the worst direction for a security tool.

The Fix: I added a 'detectChallenge()' check that inspects headers like 'cf-mitigated', 'x-amzn-waf-action', and interstitial page titles. When triggered, QuickAudit now explicitly skips header-dependent checks with an explanation rather than presenting false findings about a page that isn't yours.

Bug 2: I misread a web spec I’d have sworn I knew by heart

My Referrer-Policy auditor initially flagged 'origin-when-cross-origin' as a high-risk failure, bucketing it with 'unsafe-url' for "leaking full path and query parameters cross-origin."

Except it doesn't.

According to the W3C spec, 'origin-when-cross-origin' sends the full URL (origin + path + query) for 'same-origin' requests, but strips the path and sends 'only the origin' for cross-origin requests.

The Lesson: When you encode web security standards into lookup tables or regex rules, your own misconceptions get frozen into code and shipped to users.
'The Fix: I updated the policy matrix to reflect the exact spec table. 'origin-when-cross-origin` now passes cleanly.

Bug 3: Pedantry disguised as a security finding

In my original code, any site using 'X-Frame-Options: SAMEORIGIN' without a modern CSP 'frame-ancestors' directive generated a warning.

Technically, CSP 'frame-ancestors' is the modern standard. But in practice, 'every major current browser honors X-Frame-Options'. Flagging this on sites like 'stripe.com', 'python.org', and 'nasa.gov' was pure pedantry.

The Lesson: A tool that warns you "technically you could be more fashionable" trains developers to ignore warnings. Then, when a real severity-1 finding occurs, they ignore that too.

The Fix: 'X-Frame-Options' now passes with a neutral informational note rather than a warning.

The Part I’d Repeat on Any Project: The Catch-All SPA Trap

One of the checks in QuickAudit checks for exposed sensitive files ('/.env', '/.git/HEAD', '/.htpasswd').

If you write a naive check that just requests '/.env' and checks for HTTP 200, 'every Single Page Application (SPA) with a catch-all route will report 14 critical security vulnerabilities.' Why? Because SPAs return 'HTTP 200 OK' with 'index.html' for 'any' requested path.

To solve this, QuickAudit performs a two-step fingerprint:

Requests a random nonexistent path (e.g. '/random-a8f92z') to baseline how the server handles garbage requests.
Requires the response body to match a strict content signature for that file type ('/.git/HEAD' must match '^ref:\s+refs/', '/.env' must match 'KEY=value' lines and 'must not be HTML').

Evidence snippets are also redacted in local storage so a screenshot of a report never leaks the secret it found.

Summary & Try It Out

Running against 20 real sites took an afternoon and completely refactored three core checks. If you're building any tool that renders a verdict on someone else's system, real-world corpus testing isn't optional and handling the edge cases gracefully is what builds developer trust.

QuickAudit is 100% free, privacy-first (runs locally, no accounts or telemetry), and available on all major stores: