Web App Self-Pentest Checklist

Authorized, rate-limited probe of a web app running on the user's own machine. Follow the shared probing conventions for authorization, target discovery, and output schema.

Procedure

1. Authorization preflight. Default to localhost/127.0.0.1. If a non-loopback host is named, require explicit user confirmation in chat.
2. Discover base URL per PROBING.md (env → entrypoint → ask). Record target.base_url and target.discovered_via.
3. Confirm liveness. GET / and GET /healthz//health (if any). If unreachable, return PREFLIGHT-BLOCKED.
4. Enumerate routes from the app's source if you can read it; otherwise crawl from / to depth 2 (max 50 URLs) and stop.
5. Run the rule pack below. Stop at the first request budget hit (default 200 requests).

Rules