  The past few years have witnessed a boom of miniapps, as lightweight
applications, miniapps are of great importance in the mobile internet sector.
Consequently, the security of miniapps can directly impact compromising the
integrity of sensitive data, posing a potential threat to user privacy.
However, after a thorough review of the various research efforts in miniapp
security, we found that their actions in researching the safety of miniapp web
interfaces are limited. This paper proposes a triad threat model focusing on
users, servers and attackers to mitigate the security risk of miniapps. By
following the principle of least privilege and the direction of permission
consistency, we design a novel analysis framework for the security risk
assessment of miniapps by this model. Then, we analyzed the correlation between
the security risk assessment and the threat model associated with the miniapp.
This analysis led to identifying potential scopes and categorisations with
security risks. In the case study, we identify nine major categories of
vulnerability issues, such as SQL injection, logical vulnerabilities and
cross-site scripting. We also assessed a total of 50,628 security risk hazards
and provided specific examples.
