OWASP

What the Server Knows, the Browser Shouldn't Get: Mapping the Frontend Secret-Leakage Surface