Test / display-only security evidence. No network activity, no storage, no exfiltration. Secrets are truncated. One bridge method is invoked once; all others are listed only.
Cookies readable from this origin
document.cookie, parsed. Values truncated.
No cookies readable via document.cookie (HttpOnly cookies are not exposed here).
Bridge entry points (live reflection)
These objects are injected into this untrusted origin. Discovered live from the actual bridge; method names are reflected, never invoked.
Live token probe
The native bridge actively hands a fresh token to this page.
One call to the native bridge — Android callHandler or iOS webkit.messageHandlers.*.postMessage — with {"method":"REFRESH_ACCESS_TOKEN"}. No retry, no loop.
statuspending
access token (truncated)—
Media reach
Camera/microphone are reachable to this origin (reach, not recording, is the point).
probing…
Bridge dispatch catalog
Dispatch targets of the native bridge (Android callHandler / iOS message handler). This page can reach any of them; listed for evidence and intentionally NOT invoked.
| Name | Category |
|---|---|
| REFRESH_ACCESS_TOKEN | Session |
| REFRESH_PIN_TOKEN | Session |
| REPLACE_NATIVE_TOKEN | Session |
| SIGN | Signing |
| SIGN_SIGNATURE | Signing |
| DOWNLOAD_RESOURCE | File |
| DOWNLOAD_BASE64 | File |
| DOWNLOAD_URL | File |
| COPY_TO_CLIPBOARD | File |
| DEEPLINK | Nav |
| IN_APP_BROWSER | Nav |
| EXTERNAL_BROWSER | Nav |
| BOTTOM_SHEET | Nav |
| CLOSE_WEBVIEW | Nav |
| SCREEN_ORIENTATION | Nav |
| GET_LOCATION | Sensor |
| REQUEST_PERMISSION | Sensor |
| VIBRATE | Sensor |
| AUDIO | Sensor |
| KYC_OPEN_CAMERA | KYC |
| KYC_START_LIVENESS | KYC |
| KYC_OPEN_VIDEO_SELFIE | KYC |
| KYC_PHOTO_SELFIE_SUBMISSION | KYC |
| KYC_COMPLETE_PROCESS | KYC |
| PHONE_VERIFICATION | Identity |
| OPEN_WHATSAPP | Comms |
| OPEN_EMAIL | Comms |
| GET_METADATA | Data |
| UPDATE_METADATA | Data |
| SEND_METADATA | Data |
| ANALYTICS | Analytics |