Recorded-Browse Discovery

Show Sectora exactly what your app does by browsing it yourself — the scan then tests the pages and API calls you actually used.

Why this matters

An automated crawler discovers your app by following links and rendering pages from a single start URL. That misses three things every real app has: orphan pages nothing links to, multi-step flows behind a button or wizard the crawler won't click through, and API calls that only fire on interaction (the data loads after you act, not on page render). For a server-rendered app or a flow-heavy SPA, the crawler can come back having exercised almost none of your real authenticated surface.

Recorded-browse closes that gap. You browse your own app the way a user would — log in, click into the dashboard, open a record, run a search — and hand Sectora the recording. The scan then also tests the exact pages and API calls you exercised, including the authenticated API surface where IDOR / BOLA / broken-access-control bugs live.

How to record and import

No extra tooling — your browser's DevTools already produces the file Sectora needs (a HAR — HTTP Archive).

  1. Open your app and sign in.
  2. Open DevTools (F12 / Cmd-Opt-I) and switch to the Network tab. Tick Preserve log so navigations don't clear it.
  3. Browse the parts of your app you want covered — the more flows you exercise, the more surface the scan reaches.
  4. Right-click anywhere in the Network request list → Save all as HAR with content (or the Export HAR ⬇ button).
  5. In Sectora's New Scan → Authentication step, click Import HAR / recording and select the file.

Sectora parses the file locally in your browser, splits it into page navigations and API calls, and shows a summary (“Found 23 pages and 41 API calls to submit…”) so you can confirm before starting the scan. Pair it with one of the authenticated-scan strategies so the imported routes are also crawled while logged in.

What gets scanned — and what doesn't

Recording widens what Sectora knows about; it never widens what Sectora is allowed to attack. Every host in your recording is checked against the domains you own before anything is tested:

  • Hosts you've verified (or are otherwise authorized to scan) — seeded into the scan.
  • First-party hosts you haven't verified yet — skipped, and listed after the scan starts with a “Verify domains” prompt so you can include them next time. This is common: many apps span more than one domain (e.g. a separate API host), and the recording surfaces them for you.
  • Third-party hosts (analytics, payment widgets, fonts, CDNs) — dropped automatically. Sectora never tests infrastructure you don't control.
  • Internal / private addresses — dropped for safety.

To get a different domain included, add and verify it under Settings → Domains, then re-run the scan with the same recording.

Safety

  • The recording is credential-equivalent — it carries your session cookies and auth headers. Sectora stores it encrypted with the scan and purges it once the scan finishes, exactly like an imported login session.
  • Sectora never replays destructive actions it sees in the recording — deletes, logouts, password resets, and billing mutations are filtered out so a scan can't delete your data or log itself out.
  • Repeated calls to the same endpoint (e.g. GET /items/42, /items/43…) are collapsed to a single representative so one fuzzable template is tested, not hundreds of duplicates.

When you don't need it

If your app is a straightforward server-rendered site that the crawler can walk by following links, the automated crawl already covers it. Recorded-browse pays off most for SPAs, API-driven apps, and anything with authenticated flows hidden behind interaction. It's an addition to the normal crawl, never a replacement — you always get the automated discovery too.

Availability

Recorded-browse is part of authenticated (gray-box) scanning and is available on Pro and above, alongside the other authenticated-scan strategies.