Traffic & Requests

Analyst Toolkit

What the application actually sent, and to whom.

Every network call an application makes is recorded, and every payload it sends is decoded and read. That is the ground truth underneath every other report. When a claim about privacy or security needs testing, this is where it is tested against what was actually transmitted.

A single page load sends data outward many times over, and some of those calls carry fingerprinting or personal information that nobody signed off on. That is the gap between what an application is understood to do and what it does. Alongside the payloads sit the cookies left on your visitors, and the redirects that quietly moved someone from an encrypted connection to an open one.

SCVue HTTP POST report listing every call that transmitted a payload, with a detail panel decoding one payload and flagging device fingerprinting and tracking behavior.
Every call that carried a payload, decoded, with what the engine found inside it flagged alongside.

Integrated Reports

  • Requests / Calls

    Every network call the application made, with the full request and response behind each one. This is the ground truth underneath every other report: when a finding elsewhere raises a question, this is where you read the raw evidence.

  • Payloads

    The calls that sent information out rather than fetching something in, and what the engine found inside each one: fingerprinting, personal information, tracking. This is the privacy report. It is where "we do not share personal data with third parties" gets tested against what was actually transmitted.

  • Endpoints / URLs

    What kinds of things the application loads and who it loads them from, as a flow from content type to domain to hostname. It is where one supplier delivering an unexpectedly broad range of content stands out, or a content type arriving from somewhere it has no business coming from.

  • Redirects

    Every time a visitor was bounced from one address to another, with multi-hop chains reconstructed into one journey and two things flagged: whether it crossed to another domain, and whether it dropped from an encrypted connection to an open one. Redirect chains are a common route for tracking and for hijacking.

  • Cookies

    Every cookie set or sent, with the three attributes that separate a well configured cookie from one that can be stolen or used to track people across the web, so non-compliance is immediately visible. Values are truncated, so the report is safe to circulate.

  • Local Storage / Databases

    What a site leaves behind on a visitor's device after the session ends, with the same detail as the cookie report narrowed to what actually stays on the machine.

Analyst Toolkit

One capture is enough to start

Capture a session in the browser, import it, and read what comes back. A free community account is available immediately.

Start Free Request a Demo