agent.webapp-securityWeb app security (authenticated flows)
Exercises a running app the user is authorised to test, with the provided test account(s): session handling, logout, CSRF, cookie flags, cross-account access, error leakage and login rate limiting. (agentic, uses Claude)
- Engine
- Agent
- Targets
- Web app, URL
- Areas
- Security
- Runs
- Opt-in: only when selected with --only
- Network
- Contacts services beyond the target
Run only this auditor
bunx openaudit https://example.com --browser --only agent.webapp-securityRuns a playbook with the Claude Agent SDK. Needs ANTHROPIC_API_KEY or a Claude Code login; host agents can run the same playbook over MCP without a key.
Playbook
Exercises a running app the user is authorised to test, with the provided test account(s): session handling, logout, CSRF, cookie flags, cross-account access, error leakage and login rate limiting.
Host agents fetch it with get_playbook over MCP. How playbooks work