I tested my security extension against 20 real sites and found three bugs - in my own tool

I built 'QuickAudit', a browser extension that runs ten OWASP-style security checks on whatever web page you're currently viewing (headers, cookie flags, mixed content, vulnerable JS libraries via OSV.dev, exposed files). Before publishing, I pointed it at a corpus of 20 real-world websites- ten major security vendor sites and ten older enterprise properties - expecting a quick validation exercise to confirm everything worked. Instead, it turned into a bug hunt. And the bugs were all mine. Here are the three biggest false-positive traps I uncovered in my own code, and how testing against a live corpus changed the architecture. Bug 1: I was auditing Cloudflare's challenge page and calling it your website During the corpus test, QuickAudit reported 'sourceforge.net' as missing HTTP Strict Transport Security (HSTS). Surprised, I opened terminal and ran 'curl -I https://sourceforge.net '. The header was right there: 'strict-transport-security: max-age=31536000; includeSubDomains; preload'. Why was my extension flagging it? It turned out my automated scan had been served a Cloudflare bot-protection interstitial page in 44ms. The extension was faithfully auditing the challenge page’s headers, not Sourceforge's actual production application. The Lesson: Any security tool that programmatically fetches a URL rather than inspecting a real, fully completed browser navigation inherits this bug — and it fails toward confident wrongness, which is the worst direction for a security tool. The Fix: I added a 'detectChallenge()' check that inspects headers like 'cf-mitigated', 'x-amzn-waf-action', and interstitial page titles. When triggered, QuickAudit now explicitly skips header-dependent checks with an explanation rather than presenting false findings about a page that isn't yours. Bug 2: I misread a web spec I’d have sworn I knew by heart My Referrer-Policy auditor initially flagged 'origin-when-cross-origin' as a high-risk failure, bucketing it with 'unsafe-url' for "leaking ful