PWA Security Assessment

It tests a Progressive Web App for security weaknesses using the OWASP WSTG for the web application, plus the extra surface a PWA adds — the service worker, offline storage, the manifest, push and background sync — with every finding proven and rated.

A PWA is a web app first, so it needs the full web test. On top of that, the service worker, offline caches, and device storage add risks a normal web test does not look at — poisoned caches, sensitive data kept offline, and a service worker with too broad a scope.

The OWASP Web Security Testing Guide for the web application, and current PWA security guidance for the service worker, storage, manifest, and secure-context features.

We can work black-box from the outside, grey-box with a test account per role, or white-box with source access. Grey-box is the usual choice; white-box with the source gives the deepest coverage of the client logic and the service worker. We agree the depth and scope before we begin.

A service worker runs in the background and intercepts the app's network requests. If its scope is too broad, its update path is weak, or its caching is careless, it can serve stale or poisoned responses, keep sensitive data in a cache the user forgets about, or persist beyond a session. We test each of these paths.

It can be. Data stored in Cache Storage, IndexedDB, or local storage stays on the device and is readable by any script that runs in the origin — and, on a shared or lost device, by whoever holds it. We check what is stored, whether it needs to be, and whether it is protected.

Yes. A strong Content Security Policy is one of the best defenses against cross-site scripting, which is a leading web risk, so we review it and the other security response headers as part of every assessment.

Each finding gets a CVSS score for a common baseline, adjusted by the real impact in your application — what an attacker reaches, how easily, and what data or accounts are at risk. That is why two issues with the same CVSS can be prioritized differently.

Yes — after you remediate, we re-test the reported findings to confirm each fix holds. Duration depends on the size and complexity of the application; a typical assessment runs about one to three weeks, and we give a firm estimate after scoping.