What problem does it solve? Single-page applications ship their entire backend API route map to the browser inside JavaScript bundles, and the APIs behind them frequently lack the authentication that the login page implies. This Skill guides you through discovering those hidden routes and testing them for broken access control during authorized security engagements. ## Core Features & Use Cases - Bundle Harvesting: Download and grep React, Vue, Angular, and Next.js bundles (including lazy-loaded async chunks) for API hosts, versioned route strings, and leaked secrets. - Unauthenticated Route Testing: Establish a gated control endpoint, then test every discovered route without an Authorization header to detect missing auth middleware, verbose errors, and client-supplied privilege flags like is_admin. - Use Case: During an authorized engagement against console.target.com, you pull the JS bundles, extract routes like account/payment/list, and find that api.target.com returns data with no token — proving an unauthenticated financial API that automated scanners missed. ## Quick Start Analyze the JavaScript bundles of the target SPA at console.target.com, extract its backend API routes, and test each route unauthenticated for broken access control.
