Showcase: outside-in "leak check" of a production Next.js + Stripe app on Windows

[gold567200]

Target: Our own production client portal (Next.js 16 / Turbopack, Postgres, Stripe, behind a Cloudflare Tunnel), checked from the outside with no code access first, then cross-checked against source.

Question: What can an attacker see and reach without logging in? Specifically: secrets or source in the shipped JavaScript, hidden endpoints, auth bypasses, and transport and header gaps.

How REA helped:

• list-browser-targets + inspect-web-page against an isolated headless Chrome (own temp profile, loopback CDP) gave evidence-backed answers to "what does this page load and store": 15 scripts, none declaring a source map, and zero localStorage, sessionStorage or IndexedDB keys, so there are no tokens for an injected script to steal. The evidence IDs went straight into the client-style report.
• The same install covered our other targets on one Windows 11 machine: Ghidra 12.1.4 (Windows P0) for a native PE in ~29 s cold, JADX for an APK (2,876 classes in 6 s), and REA + Linux Ghidra in WSL for a DLL in 35 s.

What we found:

• Nothing secret shipped: no keys, internal hosts or env names in 694 KB of JS, and all .map URLs 404.
• Access control held: admin and dashboard redirect without a session, fake cookies and forged magic-link tokens were rejected, unsigned Stripe and Retell webhooks got 400/401, and the x-middleware-subrequest bypass didn't work.
• One real issue: the app host served the login form over plain HTTP (the apex domain redirected, the tunnel host didn't). The Secure session cookie and HSTS limited the impact. Fixed with Cloudflare's Always Use HTTPS.

Rough edge, for the maintainers: analyze-javascript-application on the downloaded Turbopack chunk directory (15 files, ~700 KB) ran 20+ minutes at ~3.5 GB RSS without finishing (6.3.0, Windows, Node 24.21). Happy to share more detail if useful.

We now offer this as a fixed-price service for small businesses and indie apps: https://goldenrockadvancements.com/audit/

[elkahtersidi]

سلام عليكم