GitHub - brianhama/in-browser-sec-audit: Google Chrome security audit tool · GitHub

/" data-turbo-transient="true" />

Skip to content

Type / to search

Sign in<br>Sign upAppearance settings

You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

{{ message }}

brianhama

in-browser-sec-audit

Public

Notifications<br>You must be signed in to change notification settings

Fork

Star

main

BranchesTags

Go to file

CodeOpen more actions menu

Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit

History<br>1 Commit<br>1 Commit

background

background

content

content

devtools

devtools

docs

docs

icons

icons

lib

lib

popup

popup

README.md

README.md

manifest.json

manifest.json

View all files

Repository files navigation

In Browser Security Audit Chrome Extension

A Chrome extension (Manifest V3) that, when enabled for a tab , captures every<br>first-party JavaScript file the site loads and sends it to an OpenAI model<br>with a prompt tuned to surface server-side attack vectors — API endpoints,<br>injectable parameters, SSRF/IDOR/SQLi/auth-bypass surface, leaked secrets — plus<br>concrete routes for further testing . Results render in a<br>dedicated Security Audit panel in Chrome DevTools.

I built this tool because it automates the workflow that I usually use to kick<br>off a pentest for a website. It doesn't do anything too fancy, but it saves me<br>a lot of time and I thought others might find it useful as well. Feel free to<br>submit pull requests.

What it does

Per-tab toggle from the toolbar (and from the panel). Off by default; the<br>content script stays completely idle until you enable a tab.

First-party only. Third-party CDNs/analytics are ignored. Scope is<br>configurable: same-origin (default), same-hostname, or same-site (eTLD+1, approx).

Server-side focus. The default prompt treats client JS as a map of the<br>backend and hunts for: reconstructed API/GraphQL/RPC endpoints, injection<br>reaching the server (SQLi/NoSQLi/command/SSTI/XXE), SSRF, IDOR & broken access<br>control, mass assignment, auth weaknesses, path traversal, insecure<br>deserialization, business-logic gaps, and secret/config leakage.

DevTools panel with per-script cards: overall risk, reconstructed endpoint<br>table, detected secrets, and findings (severity, confidence, CWE, evidence,<br>testing routes , and a fix).

Configurable API key, model (picker + custom id), OpenAI-compatible base<br>URL, concurrency, chunk size, temperature, token budget, inline-script<br>analysis, skip patterns, and a custom system prompt.

Extras: content-hash result cache (dedupes identical bundles), large-file<br>chunking, a paste-a-snippet analyzer, severity/text filtering, and<br>Markdown/JSON report export.

Install (unpacked)

Open chrome://extensions, enable Developer mode .

Load unpacked → select this folder.

Configure

Open DevTools (⌥⌘I / F12)

Security Audit tab

gear icon → set your OpenAI API key and model

Save .

Audit Website

Open a site you're authorized to test. Click the toolbar icon → Audit this tab .

Open DevTools (⌥⌘I / F12)

Security Audit tab

How capture works

A document_start content script (all frames) watches for elements<br>and resource performance entries, fetches first-party script bodies<br>(same-origin fetch, so no CORS issues), hashes them, and forwards them to the<br>background service worker. The worker runs a bounded-concurrency queue of OpenAI<br>calls, caches by content hash, and streams results to the panel over a<br>long-lived port. Because the DevTools panel occupies the tab's debugging<br>channel, capture deliberately avoids chrome.debugger and relies on<br>content-script fetches instead.

Permissions

Permission<br>Why

storage<br>Settings + result cache (local); per-tab runtime state (session).

tabs<br>Resolve the active tab / its origin; message content scripts.

scripting<br>Inject the content script into a tab that was loaded before enabling.

activeTab<br>Grants host access to the current tab on the toolbar click, so enabling a pre-existing tab can inject and start immediately.

webNavigation<br>Distinguish real document commits from SPA history/hash changes, so in-app navigation doesn't wipe results.

host_permissions: api.openai.com<br>Call the OpenAI API from the background/panel.

optional_host_permissions<br>Requested on demand: the page origin when you enable, a custom base-URL host, and broad host access when you pick a non-origin scope.

content scripts on http(s)://*<br>Observe scripts on the site under test (idle unless enabled; only the top frame and same-origin subframes ever capture).

Privacy & safety notes

Your API key is stored in chrome.storage.local on your machine and sent only<br>to the endpoint you configure (default api.openai.com).

First-party script source code is sent to that endpoint for analysis. Don't<br>enable this on sites whose code you may not submit to a...