When auditing a modern B2B SaaS web application—whether you are benchmarking a competitor's pricing/checkout flow or verifying your own multi-tenant authentication boundaries before a SOC 2 pen-test—two client-side surfaces reveal the most architectural detail:
- The Pricing & Checkout DOM: How the application structures its billing engine (
Stripe Billing,Paddle MoR,Lemon Squeezy,Chargebee,Orb), decoy anchor tiers, annual discount framing, and usage-based sliders. - Client-Side Web Storage (
localStorage&sessionStorage): Unencrypted Base64URL JWT payloads (eyJ...) containing tenant roles, feature flags, and expiration windows, alongside accidentally persisted API keys (sk-,ghp_,xoxb-) left behind by client-side SDKs.
Here is a 5-row teaser from our 150 B2B SaaS Pricing Page Architecture Benchmark, followed by a clean Manifest V3 snippet for auditing client-side JWT claims and accidental secret leaks in real time.
1. Teaser: 5 B2B SaaS Pricing Page & Billing Engine Architectures (From Our 150-Row Dataset)
Across 150 top B2B SaaS products, high-converting pricing pages combine a predictable seat or usage metric with a decoy middle/pro anchor and a 17%–25% annual commitment discount:
| Company | Category | Billing Engine | Primary Value Metric | Free Tier / Trial Model | Annual Discount Framing | Decoy / Anchor Architecture |
|---|---|---|---|---|---|---|
| Linear | DevTools | Stripe Billing | Active Users | Free forever up to 250 active issues | 20% off ("2 months free" toggle default-checked) | Standard ($8/user) vs. Plus ($14/user) highlighted with SSO & SAML |
| PostHog | Product Analytics | Stripe + Custom Metering | Monthly Events / Replays | Generous monthly free allowance (1M events) | Usage-based tiered volume discounts | Interactive log-scale event slider with instant unit-cost breakdown |
| Resend | Email API | Stripe Billing | Monthly Emails Sent | 3,000 emails/mo (100/day cap) | 20% off on Pro ($20/mo) and Scale ($90/mo) | Daily rate-limit cap on Free forces immediate upgrade to Pro ($20) for production apps |
| Supabase | Backend / DB | Stripe Billing | Compute Instance + Active MAUs | 2 free projects (paused after 7 days inactivity) | Predictable $25/mo Pro base + compute add-ons | 7-day inactivity pause on Free acts as the primary B2B conversion gate |
| Raycast | Productivity / AI | Stripe Billing | Per User + AI Model Tier | Free core launcher forever | 20% off ($8/mo billed annually vs. $10/mo) | Advanced AI models (Claude Sonnet / GPT-4o) gated as an $8/mo add-on |
(The full 150-row CSV dataset is bundled inside **StripeRay* below, alongside the live DOM pricing & checkout extractor extension).*
2. Client-Side JWT Claims Decoding & Storage Secret Leak Auditing in Manifest V3
During multi-tenant QA testing, digging through Application -> Local Storage in Chrome DevTools and manually pasting tokens into jwt.io is both slow and risky (if developers paste production session tokens into third-party websites).
With a 100% local Manifest V3 content script, you can scan window.localStorage and window.sessionStorage, decode Base64URL JWT payloads in memory, flag expired tokens, and check for high-entropy secret prefixes without a single byte leaving the browser:
// Manifest V3 LocalStorage JWT Claims Decoder & Secret Leak Auditor (Teaser Snippet) export function auditClientStorageSecurity() { const JWT_REGEX = /^eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/; const SECRET_PATTERNS = [ { type: 'OpenAI / Stripe Secret Key', regex: /\b(sk-[a-zA-Z0-9]{20,}|sk_live_[a-zA-Z0-9]{20,})\b/ }, { type: 'GitHub PAT', regex: /\b(ghp_[a-zA-Z0-9]{30,}|github_pat_[a-zA-Z0-9_]{30,})\b/ }, { type: 'Slack Bot/User Token', regex: /\b(xox[baprs]-[a-zA-Z0-9-]{15,})\b/ } ]; const decodeBase64UrlJson = (segment) => { try { const base64 = segment.replace(/-/g, '+').replace(/_/g, '/'); const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '='); return JSON.parse(decodeURIComponent(escape(window.atob(padded)))); } catch { return null; } }; const findings = { jwts: [], secretLeaks: [] }; for (const [storeName, storage] of [['localStorage', window.localStorage], ['sessionStorage', window.sessionStorage]]) { for (let i = 0; i < storage.length; i++) { const key = storage.key(i); const rawValue = storage.getItem(key) || ''; // 1. Check for raw or JSON-nested JWTs const candidateTokens = rawValue.match(/eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g) || []; for (const token of candidateTokens) { if (!JWT_REGEX.test(token)) continue; const [headerSeg, payloadSeg] = token.split('.'); const claims = decodeBase64UrlJson(payloadSeg); if (claims) { const isExpired = claims.exp ? (claims.exp * 1000 < Date.now()) : false; findings.jwts.push({ storeName, key, header: decodeBase64UrlJson(headerSeg), claims, isExpired }); } } // 2. Audit for accidental plaintext secret keys in browser storage for (const rule of SECRET_PATTERNS) { if (rule.regex.test(rawValue)) { findings.secretLeaks.push({ storeName, key, secretType: rule.type }); } } } } return findings; } Get the Complete Manifest V3 Chrome Extensions & Engineering Kits
All of our Chrome extensions run 100% locally in your browser (Load Unpacked ready in chrome://extensions) and include full unminified source code (use code STACKOPS20 on Payhip for 20% off):
-
#51 — StripeRay: SaaS Pricing Page, Billing Engine & Anchoring X-Ray Chrome Extension (MV3) + 150 Pricing Teardowns CSV ($24)
Detect payment processors and billing engines (Stripe,Paddle,Lemon Squeezy,Chargebee,Orb), extract price tiers and annual discount anchors from the live DOM, and get the full 150-row B2B SaaS Pricing Page Benchmark CSV.- Payhip ($24): https://payhip.com/b/Hl6LB
- Ko-fi Shop ($24): https://ko-fi.com/s/0ecc44685d
-
#52 — StorageX: Live JWT Claims Decoder, LocalStorage Secret Leak Auditor & Multi-Tenant Session Snapshotter ($24)
Automatically decode JWT claims (exp,sub,org_id,role,scope) acrosslocalStorageandsessionStorage, audit for leaked API keys, and export multi-tenant session JSON snapshots in one click.- Payhip ($24): https://payhip.com/b/IueNt
- Ko-fi Shop ($24): https://ko-fi.com/s/bad62fb7d9
-
#50 — The Complete 8-in-1 Chrome Extension & Anti-Slop Developer Suite ($39 — $205+ Value)
Master bundle of our MV3 Chrome Extensions + the MV3 License Key Monetization Boilerplate + the 12 Anti-AI-Slop UI Design Systems Pack:- Payhip ($39): https://payhip.com/b/KJ4VD
- Ko-fi Shop ($39): https://ko-fi.com/s/5307bc654b
-
More Standalone MV3 Chrome Extensions & Kits (#41–#49)
- #48 Chrome Extension Monetization & Shadow-DOM Boilerplate Kit ($29): Payhip | Ko-fi Shop
- #49 MailGuard: Cold Email Spam-Trigger & Live MX/DMARC Scorer ($24): Payhip | Ko-fi Shop
- #46 SubKill: SaaS Trial-Trap, Zombie Seat & Retention Discount Detector ($24): Payhip | Ko-fi Shop
- #47 RestGuard: Local API Request Interceptor & Mock Override ($19): Payhip | Ko-fi Shop
- #44 Anti-AI-Slop 12 UI Design Systems Pack (.cursorrules + CLAUDE.md) ($24): Payhip | Ko-fi Shop
- #45 PromptDock: AI Prompt Vault & Chat-to-Markdown Exporter ($19): Payhip | Ko-fi Shop
- #41 StackRay: B2B Lead, Tech-Stack & Live DNS/MX X-Ray ($24): Payhip | Ko-fi Shop
- #42 StealThisUI: Website Design System to Cursor/Claude Prompt ($19): Payhip | Ko-fi Shop
- #43 CiteCheck: Technical SEO, JSON-LD & /llms.txt Auditor ($19): Payhip | Ko-fi Shop
- Flagship All-Access Engineering, Security & FinOps Vault ($49): Payhip | Ko-fi Shop
