[ 04 / 05 ]
A scan is a host, a recorded session, a replay across identities, and a classification. Mutating requests stay on the catalog until you leave read-only mode.
01
The scan starts from the URL you give it.
Add a target with its base URL. Before the first scan, publish the target token as a DNS TXT record or at /.well-known/routelint-verification.txt. The queue accepts the job after that check matches. Production targets still ask for an extra confirmation and stay read-only.
02
The browser is the client.
Playwright opens the base URL once per identity. It records XHR and fetch calls that stay inside scope, follows a bounded set of same-origin links, and clicks a small number of safe controls. Request bodies stay in worker memory for replay. Only a redacted copy is written to the database.
03
Three sessions, one request.
Anonymous, User A, and User B each receive the captured URL and body. A cross-user finding needs a matching status and a highly similar body. Parameterized paths can substitute an id observed during capture. Method changes such as PUT or DELETE run only when the target is not read-only.
04
The response is labeled, then redacted.
Rules mark tokens, keys, cards, hashes, contact data, internal addresses, and stack traces. Each finding is fingerprinted by method, path, category, and identity so a later scan updates the same row instead of opening a duplicate.
Identities
Anonymous is created with the target. You add two authenticated identities and link them as peers. Bearer tokens, API keys, and a basic form login are supported.
No cookie and no authorization header. This pass is the unguarded-access suite.
The account whose calls are captured and then replayed. Its objects are the baseline.
The peer. The same URL and body are sent with B’s credentials to test cross-user access.
Guardrails
These checks run before a request leaves the scanner. They apply to capture and to replay.
Requests outside the target’s allowed hosts are aborted in the browser and refused by the worker.
Link-local and cloud metadata addresses are blocked. Production scans require an extra confirmation and stay at one request per second.
A deny-list skips routes that delete, log out, or pay. The crawler does not click those controls.
Identity secrets are encrypted with AES-256-GCM. They are decrypted in the worker to build auth headers and are never written into findings.
