I tested my security extension against 20 real sites and found three bugs - in my own tool

I built 'QuickAudit', a browser extension that runs ten OWASP-style security checks on whatever web page you're currently viewing (headers, cookie flags, mixed content, vulnerable JS libraries via OSV.dev, exposed files). Before publishing, I pointed it at a corpus of 20 real-world websites- ten major security vendor sites and ten older enterprise properties - expecting a quick validation exercise to confirm everything worked. Instead, it turned into a bug hunt. And the bugs were all mine. Here are the three biggest false-positive traps I uncovered in my own code, and how testing against a live corpus changed the architecture. Bug 1: I was auditing Cloudflare's challenge page and calling it your website During the corpus test, QuickAudit reported 'sourceforge.net' as missing HTTP Strict Transport Security (HSTS). Surprised, I opened terminal and ran 'curl -I https://sourceforge.net'. The header was right there: 'strict-transport-security: max-age=31536000; includeSubDomains; preload'. Why was my extension flagging it? It turned out my automated scan had been served a Cloudflare bot-protection interstitial page in 44ms. The extension was faithfully auditing the challenge page’s headers, not Sourceforge's actual production application. The Lesson: Any security tool that programmatically fetches a URL rather than inspecting a real, fully completed browser navigation inherits this bug - and it fails toward confident wrongness, which is the worst direction for a security tool. The Fix: I added a 'detectChallenge()' check that inspects headers like 'cf-mitigated', 'x-amzn-waf-action', and interstitial page titles. When triggered, QuickAudit now explicitly skips header-dependent checks with an explanation rather than presenting false findings about a page that isn't yours. Bug 2: I misread a web spec I’d have sworn I knew by heart My Referrer-Policy auditor initially flagged 'origin-when-cross-origin' as a high-risk failure, bucketing it with 'unsafe-url' for "leaking full path and query parameters cross-origin." Except it doesn't. According to the W3C spec, 'origin-when-cross-origin' sends the full URL (origin + path + query) for 'same-origin' requests, but strips the path and sends 'only the origin' for cross-origin requests. The Lesson: When you encode web security standards into lookup tables or regex rules, your own misconceptions get frozen into code and shipped to users. 'The Fix: I updated the policy matrix to reflect the exact spec table. 'origin-when-cross-origin` now passes cleanly. Bug 3: Pedantry disguised as a security finding In my original code, any site using 'X-Frame-Options: SAMEORIGIN' without a modern CSP 'frame-ancestors' directive generated a warning. Technically, CSP 'frame-ancestors' is the modern standard. But in practice, 'every major current browser honors X-Frame-Options'. Flagging this on sites like 'stripe.com', 'python.org', and 'nasa.gov' was pure pedantry. The Lesson: A tool that warns you "technically you could be more fashionable" trains developers to ignore warnings. Then, when a real severity-1 finding occurs, they ignore that too. The Fix: 'X-Frame-Options' now passes with a neutral informational note rather than a warning. The Part I’d Repeat on Any Project: The Catch-All SPA Trap One of the checks in QuickAudit checks for exposed sensitive files ('/.env', '/.git/HEAD', '/.htpasswd'). If you write a naive check that just requests '/.env' and checks for HTTP 200, 'every Single Page Application (SPA) with a catch-all route will report 14 critical security vulnerabilities.' Why? Because SPAs return 'HTTP 200 OK' with 'index.html' for 'any' requested path. To solve this, QuickAudit performs a two-step fingerprint: - Requests a random nonexistent path (e.g. '/random-a8f92z') to baseline how the server handles garbage requests. - Requires the response body to match a strict content signature for that file type ('/.git/HEAD' must match '^ref:\s+refs/', '/.env' must match 'KEY=value' lines and 'must not be HTML'). Evidence snippets are also redacted in local storage so a screenshot of a report never leaks the secret it found. Summary & Try It Out Running against 20 real sites took an afternoon and completely refactored three core checks. If you're building any tool that renders a verdict on someone else's system, real-world corpus testing isn't optional and handling the edge cases gracefully is what builds developer trust. QuickAudit is 100% free, privacy-first (runs locally, no accounts or telemetry), and available on all major stores: - 🌐 Chrome Web Store: https://chromewebstore.google.com/search/QuickAudit - 🌐 Microsoft Edge Add-ons: https://microsoftedge.microsoft.com/addons/detail/0RDCKBGQ6TZM - 🦊 Firefox AMO: https://addons.mozilla.org/en-US/firefox/addon/quickaudit-web-security/ - 💻 Source Code: https://github.com/BAB78/quickaudit I'd love to hear feedback or edge cases from other web & security engineers! Top comments (0)