Taming SPAs with VORTEX: How a Crawler Actually Understands React, Vue, and Angular

💡Let’s run a mental experiment. You open a SPA built with React. You point your favorite scanner—the one you've used for years, the one that "never fails"—to audit it. You wait. It generates a neat, polished report with a nice logo and a progress bar. And it tells you: "2 routes found. 0 critical vulnerabilities." Two routes. In an application featuring a complete dashboard, an admin panel, over forty endpoints, and half a dozen features locked behind feature flags. The scanner isn't broken. The scanner is blind. And nobody told it. That was, literally, the starting point of VORTEX Assessment Engine . In my previous post, I covered the overall architecture: a self-hosted engine, a native binary, zero heavy dependencies, and direct CI/CD pipeline integration. Today, I want to lift the hood and show you the piece that makes all of that actually matter: the crawler, and what happens when it steps directly inside the JavaScript instead of just staring at it from the outside. If you're a developer , this might sting a little. If you're a DevOps engineer, you'll care about how it plugs into the pipeline. And if you're a pentester... well, you already know exactly what I'm talking about. 🧱 HTML Is No Longer a Map. It’s a Lid. Let's look at the facts. This is what a curl response to a modern SPA looks like: <div id="root"></div> <script src="/static/js/main.a1b2c3.js"></script> That is literally all there is. No <a href> , no forms, no routes, nothing that a 2000s-era HTML parser can chew on. The entire application—components, router, API calls, business logic, validations, everything—is compressed and minified inside that single .js file, and it gets built right inside the browser in real-time the moment a user hits the page. A crawler that only knows how to read HTML is staring at a locked door with a sign saying "nothing to see here." And it actually believes it. This isn’t a minor limitation or an academic edge case. It’s the exact reason why, year after year, we keep s