News
Web App Manifest vs Public Metadata on Production
May 12, 2026
Web app manifest vs public metadata on production is a PWA catalog versus other JSON you accidentally ship. /manifest.webmanifest or /manifest.json names the app, icons, start_url, and display mode so installing the site works. It is fetched by browsers without a login. API keys, staging hostnames, and admin start_url values do not belong there. package.json on a public origin is a different leak (dependency map). assetlinks.json proves which native apps may open your URLs. RoastMyOpsec does not score the web app manifest. It may signature-check public package.json. Missing a manifest is a PWA gap, not an OPSEC F.
The practical difference
The manifest is advertising: name, theme color, icons. start_url should be a public HTTPS path, not /reset?token= or /admin. related_applications can list store IDs — that is fine; do not list internal package names you would not print on the homepage.
scope and id should not point at a second origin you do not control. That is an open-redirect-class product bug if start_url can leave your site.
How to choose what to publish
Production brand only. Staging manifests on staging hosts. Icons without EXIF leftover paths. start_url: the marketing or app shell you already show logged-out users. Prefer a static file with a boring Content-Type. Do not generate the manifest from .env.
| File | Audience | Must not contain | Takeaway |
|---|---|---|---|
| manifest.json / .webmanifest | Browsers installing the PWA | Secrets, admin start_url, tokens | Public by design |
| package.json | npm / curious GETs | Private app inventory if the app is private | See public package.json |
| assetlinks.json / AASA | OS App Links | Debug team IDs, secrets | See assetlinks vs AASA |
| security.txt | Researchers | VPN hostnames | Different well-known |
What the roast can prove
A 404 on the manifest is not a finding. A 200 package.json can be. Confirm start_url yourself. Pair with tokens in URLs if start_url still carries a query secret, and with sitemap.xml if you listed /manifest.json next to /backup.zip.
Common mistakes
The first mistake is start_url: '/dashboard' on a site that 302s unauthenticated users through a tokenized URL.
The second mistake is stuffing STRIPE_PK into the manifest 'for the installed app.'
The third mistake is treating a missing manifest like a missing CSP.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is a public web app manifest a vulnerability?
- No. It is supposed to be public. Secrets or an admin start_url in it are the miss.
- Should I robots.txt Disallow the manifest?
- Browsers still need it. Disallow is not access control and can break install.
- Does RoastMyOpsec fetch manifest.json?
- Not as a scored path. Missing it is not an OPSEC F.