Outside-in leak check of a Next.js and Stripe app
A black-box audit of a production portal using REA's browser tools, which found one real HTTPS issue.
Credits
Earliest dated source:
The full story
A team checked their own live client portal (Next.js, Postgres and Stripe behind a Cloudflare Tunnel) from the outside, the way an attacker would, before cross-checking the source. The question was what someone could see or reach without logging in.
REA's browser tools inspected what each page loads and stores. They found 15 scripts, no source maps, and nothing in browser storage worth stealing. The 694 KB of JavaScript contained no keys or internal addresses. Admin pages redirected properly, forged cookies and login tokens were rejected, and unsigned webhooks were refused. One real HTTPS issue turned up. The same Windows set-up also ran Ghidra and JADX for other targets.
How it was done
Tools
Themes
Loading themes…
Sources
From the maker's own write-up or code. We summarise what they report; we haven't tested it ourselves.
- Awesome REA list: Outside-in leak check of a Next.js and Stripe appRepository account: morlutoPublished
The showcase: target, method, tool timings and findings.