Website Security Audit: a Tokeny case study
Scan dependency vulnerabilities, detect sensitive data leaks, review common security risks, and output fix suggestions. Follow the recorded task, execution screenshots, actual files and verification notes.
By the Tokeny team · Windows · Tokeny 1.7.8 · gpt-6-sol
Prepare the inputs
Create a separate workspace in Tokeny, download and unpack the sample inputs, then select a model that supports tools. The sample uses synthetic data or the public sources named in the article.
- app.js
- package.json
Send the task to Tokeny
The original task was executed in Chinese. Copying these instructions reproduces the same task; the results below include an English report.
对本地虚构项目做静态安全检查，重点检查字符串拼接、输出编码和疑似凭据；输出带路径的发现与修复。只审查输入样例，不扫描真实网站。 交付文件：security-review.md、app-fixed.mjs。 验收要点： - 识别反射型 HTML 注入 - 说明演示字符串不是真实密钥 - 不声称执行了外网漏洞扫描 这是使用合成演示输入或指定公开资料的真实操作案例。请先读取工作空间输入，再实际生成文件并自检。所有写入、脚本与临时服务限于当前工作空间；临时服务只监听 127.0.0.1，执行后关闭；不触达外部收件人、不发布、不付款、不更改系统设置，不调用子智能体。需要公开资料时可读取给定 URL。只启用完成任务必需的工具。另写 report.md（中文）和 report.en.md（英文），简洁、完整，包含输入、处理步骤、真实结果、检查方式和局限；失败或未验证部分如实记录，不能宣称成功。最终回复用中文列出产物、关键结果与待核实项。
The recorded run used an isolated demonstration workspace. Review the commands and file paths before approving operations in your own workspace.
What actually ran
The task was submitted through the Tokeny input box. An online model read the inputs and executed tools. This run covers the local sample task and its actual files. Results and checks are recorded below.
Results and verification
Input
The reviewed synthetic demo inputs were app.js, package.json, and ENVIRONMENT.md in the current workspace. No real website was inspected and no external vulnerability scan was run.
Processing steps
- Read and confirmed the workspace file scope.
- Reviewed string concatenation, HTML output encoding, and credential-like strings.
- Created
app-fixed.mjsto encode user input for the HTML context and handle missing input. - Used local Node.js for syntax checking and representative-input verification.
Actual results
app.js:1contains reflected HTML injection:query.nameis concatenated into<h1>without encoding.app.js:2containsDEMO_ONLY_NOT_A_REAL_SECRET. It is explicitly labeled as a demo value; this review found no evidence that it is a real password, API key, or usable credential.app-fixed.mjsencodes&,<,>,", and'before output and removes the credential-like constant.
Check method
The review used direct file reading, line-level static analysis, a Node.js module syntax check, and local calls to welcome() with plain text, HTML markup, quote characters, and missing name. No network request was made, no temporary service was started, and no external recipient was contacted.
Limitations
The conclusions apply only to the supplied local synthetic sample. They do not establish the security of a complete application, dependencies, deployment configuration, response headers, authentication flow, or real credentials. No external vulnerability scan was performed, and the demo string was not tested against any real service.
Download and inspect the outputs
The archive contains the files created during this run. Use these checks when adapting the example to your own data.
- Reconcile the reported results against the downloadable sample inputs.
- Open the generated files and check the contents relevant to your task.
- Review the limitations and any unverified steps in the report.