Auditing a whole app
I patched the holes I could see and shipped. A real audit walks every door a request can enter and proves each one is guarded, so nothing is assumed safe.
What you will see
400
About 1 min of reading
Try It
Audit one door by attacking it.
1
Send a script tag to a search route and confirm it renders as text, not code.
curl -s 'https://yoursite/search?q=' | grep -o '<script'
Before you run it, say out loud what it will print. Then open the answer.
What it prints
<script>
If the response contains a raw