I tested my security extension against 20 real sites and found three bugs - in my own tool

I built 'QuickAudit', a browser extension that runs ten OWASP-style security checks on whatever web page you're currently viewing (headers, cookie flags, mixed content, vulnerable JS libraries via OSV.dev, exposed files).

Before publishing, I pointed it at a corpus of 20 real-world websites- ten major security vendor sites and ten older enterprise properties - expecting a quick validation exercise to confirm everything worked.

Instead, it turned into a bug hunt. And the bugs were all mine.

Here are the three biggest false-positive traps I uncovered in my own code, and how testing against a live corpus changed the architecture.

Bug 1: I was auditing Cloudflare's challenge page and calling it your website

I tested my security extension against 20 real sites and found three bugs - in my own tool

Other newsrooms on this story

Related reading

I built a browser security tool that traces attacks back to their source —…

I found 10 bugs in my own security scanner. Here's what they taught me about…

I built a browser checklist tool for SEO audits and QA

We scanned 10 well-known sites with our security tool. Here's what we found.

AI Security Audit Checklist: 15 Vulnerabilities Claude Found in Production Code

I built a free cybersecurity scanner that gives any website a security score —…