Local-first Chrome security testing for AI-built apps.
VolPen is a Chrome extension that helps developers catch risky API behaviour, broken authorization, tenant leaks, and common OWASP mistakes while they use their app normally.
Start a scan, browse your product, review the findings, optionally prove exploitability with consent-gated replay checks, then export a report or copy a fix brief into Cursor, Copilot, or your IDE.
VolPen is a developer pre-flight tool. It helps you find and fix obvious security issues earlier. It is not a replacement for a professional pentest.
VolPen is available on the Chrome Web Store.
After installing:
- Pin VolPen to your Chrome toolbar.
- Open the app you want to test.
- Click the VolPen icon.
- Start capture and browse your app normally.
Replace
<chrome-web-store-url>with the live Chrome Web Store listing URL once published.
AI-assisted development makes it easier than ever to ship working software quickly. The problem is that the happy path can look perfect while basic security logic is missing underneath.
VolPen is built for that gap.
It focuses on the mistakes that often slip through fast-moving development workflows:
- broken authorization checks
- cross-tenant data leaks
- IDOR-style resource access
- sensitive tokens or session IDs in URLs
- weak API behaviour
- missing headers and cookie protections
- common OWASP-style issues
Traditional scanners are often too generic, too noisy, or too detached from the actual app flow. VolPen watches real traffic from your real session and builds security findings around how your app actually behaves.
VolPen gives you a guided five-step security workflow inside a Chrome extension popup.
| Step | What happens |
|---|---|
| 1. Capture | Lock onto a tab, browse normally, and let VolPen observe requests, endpoints, payloads, cookies, and route patterns locally. |
| 2. Review | See passive findings grouped by severity, rule, affected endpoint, and evidence. |
| 3. Prove | Run consent-gated active probes to check whether suspicious behaviour is actually exploitable. |
| 4. AI | Optionally send redacted finding summaries to Groq for validation and remediation help. |
| 5. Output | Export JSON, generate an HTML report, or copy a fix brief for Cursor, Copilot, or another coding assistant. |
Best used on localhost, development, preview, or staging environments.
VolPen currently includes 19 passive detection rules across three main areas.
- Cross-tenant data leakage
- IDOR via sequential IDs
- Mass assignment risk
- Broken authorization checks
- Rate limiting gaps
- CORS misconfiguration
- Weak JWT handling
- Excessive data exposure
- Reflected and DOM XSS signals
- SQL injection signals
- Missing CSRF tokens
- Weak cookie flags
- Sensitive data in URLs
- Open redirects
- Mixed content
Passive findings tell you where to look. Active checks help confirm whether the issue is real.
VolPen includes 8 consent-gated probes:
| Probe | Purpose |
|---|---|
IDOR |
Swap numeric IDs and compare responses. |
CROSS_TENANT |
Replay requests with foreign tenant context. |
MASS_ASSIGNMENT |
Inject privileged or unexpected fields. |
AUTH_STRIP |
Remove auth context and check whether access is still allowed. |
HEADER_STRIP |
Drop security-related headers and compare behaviour. |
SWEEP_TENANT |
Fan out tenant checks across observed endpoints. |
SWEEP_IDOR |
Enumerate profiled routes for IDOR-like access. |
SWEEP_MASS_ASSIGN |
Test observed write endpoints for unsafe field acceptance. |
Active probes are deliberately gated. VolPen requires explicit consent for the current target domain before running checks that may alter request behaviour.
VolPen can integrate with Groq using your own API key.
AI is off by default.
When enabled, VolPen can help with:
| Action | Description |
|---|---|
validate-finding |
Review passive findings and reduce noise. |
validate-active-result |
Interpret replay outcomes and confirm exploitability. |
generate-payload |
Suggest targeted payloads for authorization and mass-assignment tests. |
remediate |
Generate a framework-aware fix brief with code-level remediation guidance. |
VolPen redacts secrets client-side before AI requests. Optional AI review sends redacted finding summaries, not raw request or response bodies by default.
VolPen is designed to help you fix issues, not just document them.
You can export:
- JSON for structured analysis or downstream tooling
- HTML report for sharing findings with a team or client
- Copy-ready fix brief for Cursor, Copilot, Claude Code, ChatGPT, or another coding assistant
Example fix brief:
Finding: RLS-002 / IDOR
Endpoint: GET /api/events/:id
Evidence: Adjacent numeric IDs return 200 instead of 403/404.
Likely root cause: route param is trusted without tenant ownership validation.
Fix: enforce tenant scoping in the data query and return 404/403 for unauthorized access.
- Open the app you want to test.
- Click the VolPen extension icon.
- Click Start capture.
- Use your app normally.
- Review passive findings.
- Run active proof checks only if you own the app and understand the impact.
- Export the results or copy a remediation brief.
Recommended environments:
localhost- preview deployments
- staging environments
- disposable test tenants
- seeded demo data
Avoid active probes against production systems unless you have explicit permission and a safe test plan.
AI validation and remediation are optional.
- Open VolPen.
- Go to Settings.
- Open the AI tab.
- Paste your Groq API key.
- Enable AI validation.
AI can be disabled again at any time.
VolPen is designed around a local-first security posture.
Detection runs inside the extension. Raw app traffic is not uploaded to VolPen servers by default.
Scans are pinned to the tab and domain where capture starts. This reduces accidental cross-site collection.
Replay and mutation checks require user confirmation for the current target domain.
AI validation is opt-in. Secrets are redacted client-side before an AI request is made.
VolPen is built for Chrome Extension Manifest V3 with a strict Content Security Policy and no remote code execution.
For more detail, see:
Most users should install VolPen from the Chrome Web Store. This section is only for contributors or developers who want to build the extension locally.
- Node.js 20+
- npm
- Google Chrome or a Chromium-based browser
git clone <this-repo-url>
cd volpen
npm install
npm run build- Open
chrome://extensions - Enable Developer mode
- Click Load unpacked
- Select the generated
dist/directory - Pin VolPen to your Chrome toolbar
npm run dev # run the popup development server
npm run build # build popup, background, content, and injected targets
npm run test # run unit tests once
npm run test:watch # run tests in watch mode
npm run lint # type-check with tsc --noEmit
npm run package # build and create a zipped extension packagesrc/
├── background/ Service worker, message handlers, tab state, active-test runner
├── content/ Content scripts, DOM scanner, form monitor, message bridge
├── injected/ Page-world network interceptor
├── engine/ Passive rules, matchers, active tester, findings merger
├── llm/ Groq client, prompts, redaction, rate limiting
├── popup/ React UI, stages, components, hooks, styles
├── shared/ Types, constants, message contracts
└── storage/ chrome.storage and IndexedDB wrappers
scripts/ Build helpers, icon generation, Nuclei bundle generation
tests/ Vitest suites
The extension is built from multiple Vite targets so each Chrome extension surface can be bundled with the correct Manifest V3 shape:
- popup
- background service worker
- content script
- injected page-world script
- React
- TypeScript
- Vite
- Vitest
- Chrome Extension Manifest V3
- IndexedDB
- Groq API, optional
VolPen is security tooling. Use it responsibly.
You should only test:
- apps you own
- systems where you have explicit permission
- local, development, staging, or controlled test environments
Do not use VolPen to scan third-party systems without authorization.
If you believe you found a vulnerability in VolPen itself, please follow the process in SECURITY.md, if present, or contact the maintainer privately.
Potential next improvements:
- Chrome Web Store release
- import/export scan sessions
- GitHub issue creation from confirmed findings
- framework-specific remediation templates
- team-safe report sharing
- configurable rule packs
- CI-friendly report validation
No. VolPen is a developer pre-flight tool. It helps catch obvious and business-logic issues earlier, but a professional pentest is still recommended for production-critical systems.
Passive capture may be low risk, but active replay can change request behaviour. Start with localhost, preview deployments, staging, or disposable test tenants.
Not by default. VolPen analyzes traffic locally. Optional AI review can send redacted finding summaries only after you enable it.
VolPen needs browser extension permissions to observe tab traffic, inject its network interceptor, store scan state, and run the popup workflow. Each permission should be documented in PERMISSION_JUSTIFICATIONS.md.
VolPen is for solo builders, AI-assisted teams, agencies, and product developers who want a fast security check before sending a build to users, clients, or investors.
FUNCTIONALITY.md— full capability inventorySECURITY_OVERVIEW.md— technical security posturePERMISSION_JUSTIFICATIONS.md— MV3 permission rationalePRIVACY_POLICY.md— data handling policydesign.md— design notes
VolPen is open source under the Apache License 2.0.