trendyol.
Sign in to track your orders and vouchers
🎁 Your ₺500 voucher is waiting

Open in the Trendyol app to get your voucher

Open in Trendyol (allowlist bypass) Open in Trendyol (direct host)
Both buttons open the Trendyol app and load this page inside it. The first hops through www.youtube.com: the allowlist sees youtube, then a redirect lands here. The second loads this host directly. It tests whether the allowlist flag is on at all. Needs iOS with Trendyol installed.
Trendyol sign-in demo. This page is not the app.

Share this link with a friend to get another ₺500 voucher

Deep-link echo — what this view loaded

URL of this view (location.href)
User agent of this view
The audit found no custom user agent in the Trendyol module. Compare this UA with the app webview on device before you trust the view switch.

Keyboard event — the one native → page channel

Proven native → page JS (sub_1000212F4) The app dispatches the CustomEvent onIOSKeyboardOpen with detail.keyboardHeight. Tap the email field above to open the keyboard.
Not fired yet.

Router re-entry — page → app

Probes whether the page can hand a ty:// URL back to the app router from inside the InWeb view. The navigation policy cancels such links and routes them (inferred from sub_100023398; verify on device). If it works, this page also propagates from inside the webview.

Session probe — manual

Bounce this view to www.trendyol.com https://www.trendyol.com/
Manual probe, no automation. The InWeb view uses a dedicated cookie store (TYWebViewCookieStorageIdentifier). On device, check whether the page renders logged in. Session cookies in this store are unproven.

No JS bridge — static fact

Page → native surface on this view None. The audit (DLA-038) proved: no script-message handler on TYWebViewController, no addUserScript site, no addScriptMessageHandler site in the Trendyol module. The only native → page JS is onIOSKeyboardOpen (sub_1000212F4). Page → native is WebKit defaults only.
There is no bridge probe panel because there is no bridge to probe. The trusted chrome, the attacker title and the missing address bar are the risk, not a bridge.