Pentesting a private tracker: Nuxt.js, Cloudflare and 3 vulnerabilities found

A private BitTorrent tracker is a web application like any other: authentication, REST API, WebSockets for real-time chat, CDN in front. The difference with a standard SaaS? Members share sensitive data — download ratio, activity history, sometimes their public IP address embedded in .torrent files. A data leak has real consequences. Methodology — 5 phases A structured web pentest always follows the same rhythm. In brief: Phase Goal Tools 1. Reconnaissance Map the attack surface without touching