VolPen

VolPen is a local-first Chrome security scanner for developers building modern web apps. It watches your app's network traffic while you browse, flags risky endpoints, safely proves exploitable issues, and produces paste-ready fix briefs you can hand to Cursor, Copilot, Claude Code, or any AI coding assistant. It is built for the developers most traditional scanners miss: solo builders, AI-assisted teams, and anyone shipping a SaaS product faster than a formal pentest can keep up with. ── WHAT VOLPEN DETECTS (19 PASSIVE RULES) ────────────────────── Auth & Tenant Security • Cross-tenant data leakage between user accounts • Insecure Direct Object Reference (IDOR) via sequential IDs • Mass assignment via unchecked request fields • Broken object-level / function-level authorization • Inconsistent authorization checks across endpoints API Security • Rate limiting gaps on auth and write endpoints • CORS misconfiguration (reflected Origin, wildcard with credentials) • Weak JWT handling (none algorithm, weak secrets, missing claims) • Excessive data exposure in API responses • Missing OAuth flow validation (PKCE, state parameter) • JWT with insecure defaults or missing claims OWASP Top 10 & Web Basics • Reflected XSS — user-controlled input echoed in responses • DOM-based XSS — unsafe JavaScript sinks in page code • SQL injection signals — error-based and boolean-based patterns • Missing CSRF tokens on state-changing requests • Cookie flag hygiene — missing Secure, HttpOnly, SameSite flags • Sensitive data exposure in URLs and query strings • Open redirects — unvalidated redirect parameters • Mixed content on HTTPS pages • Error disclosure — stack traces and verbose error messages • Version disclosure — framework and server version leakage • Artifact exposure — .env files, backup files, and source maps left accessible • Secrets in client-side code — API keys, tokens, and credentials in JS bundles • Header leakage — overly verbose headers exposing server internals ── ACTIVE PROOF (8 CONSENT-GATED PROBES) ─────────────────────── When a passive finding is suspicious, VolPen can safely replay requests to confirm real exploitability. Every write-capable probe is locked behind explicit per-domain consent: • IDOR — Replays a request with an adjacent sequential ID to confirm access control gaps. • CROSS_TENANT — Substitutes a tenant identifier observed in another session to test isolation. • MASS_ASSIGNMENT — Injects escalation fields (is_admin, role, plan_tier) into request bodies. • AUTH_STRIP — Removes the Authorization header and checks whether the endpoint still responds with data. • HEADER_STRIP — Strips security headers and tests whether CORS or other protections collapse. • SWEEP_TENANT — Systematically tests multiple tenant IDs across endpoints. • SWEEP_IDOR — Bulk-probes sequential IDs across resource endpoints. • SWEEP_MASS_ASSIGN — Tests multiple escalation payloads against write-capable endpoints. All probes respect the domain-lock scope and require explicit opt-in before any request is replayed. ── OPTIONAL AI LAYER (BRING-YOUR-OWN KEY) ────────────────────── Plug in a Groq API key — or any OpenAI-compatible provider — to unlock: • validate-finding — Filters noisy passive detections by asking an LLM whether a finding is likely a true positive given the full context. • validate-active-result — Reads replay outcomes to confirm whether a mutation (e.g., mass assignment) was actually processed server-side. • generate-payload — Suggests targeted payloads based on endpoint profiling: path parameters, query strings, and observed request schemas. • remediate — Produces a clean, language- and framework-specific code fix pattern with before/after code snippets. • AI Fix Instructions — Generates a consolidated markdown brief covering all findings in one scan. Paste it into Cursor, Copilot, Claude Code, or Devin to apply fixes across your entire codebase. Secrets and request bodies are redacted client-side before any request. AI is OFF by default and requires your own API key — no credentials are bundled or shared. ── HOW IT WORKS ──────────────────────────────────────────────── VolPen drives a guided 5-step workflow inside the popup: Step 1 — CAPTURE Click "Start Scan" to lock onto the current tab. Browse your app normally — log in, navigate, submit forms, trigger API calls. VolPen passively observes every request and response, groups them by endpoint, and builds a route map of your application. Step 2 — REVIEW The popup automatically advances to show all passive findings grouped by severity (Critical, High, Medium, Low, Info). Each finding includes the affected endpoint, evidence snippets (specific header values, response fragments, or URL patterns), and reproduction context so you can understand and triage quickly. Step 3 — PROVE (optional) For findings where passive detection is uncertain, click "Verify" to replay the request with a targeted mutation. VolPen confirms whether the vulnerability is actually exploitable. Every write-capable probe requires an additional consent gate — read-only probes replay safely; write-capable ones are disabled by default and must be explicitly enabled per domain. Step 4 — AI (optional, skippable) If you've provided an API key, VolPen runs LLM-based validation and generates remediation guidance. You can skip this step entirely — all core functionality works without AI. Step 5 — OUTPUT Export your results as JSON or Markdown, copy a paste-ready AI coder prompt, or click "Start new scan" to reset and test a different application. ── ENDPOINT SWEEP (DOMAIN-WIDE RLS AUDIT) ───────────────────── Beyond the guided workflow, VolPen can systematically audit every endpoint your app exposes for Row Level Security (RLS) gaps: • Sweeps all discovered endpoints with cross-tenant and IDOR probes. • Groups results…