RoastMyOpsec

News

Web App Manifest vs Public Metadata on Production

May 12, 2026

Web app manifest vs public metadata on production is a PWA catalog versus other JSON you accidentally ship. /manifest.webmanifest or /manifest.json names the app, icons, start_url, and display mode so installing the site works. It is fetched by browsers without a login. API keys, staging hostnames, and admin start_url values do not belong there. package.json on a public origin is a different leak (dependency map). assetlinks.json proves which native apps may open your URLs. RoastMyOpsec does not score the web app manifest. It may signature-check public package.json. Missing a manifest is a PWA gap, not an OPSEC F.

The practical difference

The manifest is advertising: name, theme color, icons. start_url should be a public HTTPS path, not /reset?token= or /admin. related_applications can list store IDs — that is fine; do not list internal package names you would not print on the homepage.

scope and id should not point at a second origin you do not control. That is an open-redirect-class product bug if start_url can leave your site.

How to choose what to publish

Production brand only. Staging manifests on staging hosts. Icons without EXIF leftover paths. start_url: the marketing or app shell you already show logged-out users. Prefer a static file with a boring Content-Type. Do not generate the manifest from .env.

FileAudienceMust not containTakeaway
manifest.json / .webmanifestBrowsers installing the PWASecrets, admin start_url, tokensPublic by design
package.jsonnpm / curious GETsPrivate app inventory if the app is privateSee public package.json
assetlinks.json / AASAOS App LinksDebug team IDs, secretsSee assetlinks vs AASA
security.txtResearchersVPN hostnamesDifferent well-known

What the roast can prove

A 404 on the manifest is not a finding. A 200 package.json can be. Confirm start_url yourself. Pair with tokens in URLs if start_url still carries a query secret, and with sitemap.xml if you listed /manifest.json next to /backup.zip.

Common mistakes

The first mistake is start_url: '/dashboard' on a site that 302s unauthenticated users through a tokenized URL.

The second mistake is stuffing STRIPE_PK into the manifest 'for the installed app.'

The third mistake is treating a missing manifest like a missing CSP.

Free audit the URL you own

RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.

Free audit now

FAQ

Is a public web app manifest a vulnerability?
No. It is supposed to be public. Secrets or an admin start_url in it are the miss.
Should I robots.txt Disallow the manifest?
Browsers still need it. Disallow is not access control and can break install.
Does RoastMyOpsec fetch manifest.json?
Not as a scored path. Missing it is not an OPSEC F.

Sources

Related guides