https://securedx.in/research Security writeups and methodology notes from SecureDX. https://securedx.in/research/javascript-is-a-recon-goldmine https://securedx.in/research/javascript-is-a-recon-goldmine Wed, 04 Nov 2026 00:00:00 GMT A six-step workflow for JavaScript recon on pentests and bug bounty, plus a checklist for developers on what not to ship in front-end code. https://securedx.in/research/javascript-recon-part-2-advanced-techniques https://securedx.in/research/javascript-recon-part-2-advanced-techniques Wed, 04 Nov 2026 00:00:00 GMT What to do when grep and a crawler aren't enough: route manifests, recovering every webpack chunk, parsing calls with Babel, recording traffic per role, and diffing static against runtime. https://securedx.in/research/javascript-recon-part-3-automating-the-pipeline https://securedx.in/research/javascript-recon-part-3-automating-the-pipeline Wed, 04 Nov 2026 00:00:00 GMT Four small scripts and one SQLite file per target: collect, extract, remember, alert, and hand yourself a ranked list of routes to test by hand. https://securedx.in/research/recon-is-where-bugs-are-found https://securedx.in/research/recon-is-where-bugs-are-found Wed, 04 Nov 2026 00:00:00 GMT A five-stage recon pipeline for pentests and bug bounty, with commands for each stage and a checklist of what to look at once the output lands. https://securedx.in/research/recon-part-2-advanced-recon-for-2027 https://securedx.in/research/recon-part-2-advanced-recon-for-2027 Wed, 04 Nov 2026 00:00:00 GMT What to do after subfinder, httpx and ffuf: organisation mapping, CDN origins, code leaks, deep JavaScript, exposed AI and MCP servers, and continuous recon. https://securedx.in/research/recon-part-3-recon-for-defenders https://securedx.in/research/recon-part-3-recon-for-defenders Wed, 04 Nov 2026 00:00:00 GMT How defenders use the same recon attackers run: inventory what you own, alert on change, fix the common exposures, publish a disclosure policy, and follow a 30-day plan.