CheckVibeCodeCheckVibeCode
Checks/Vulnerability
VulnerabilityLive — needs Playwright3 checks

Browser Storage & Session Token Scanner

Detect JWTs, refresh tokens, and session identifiers stored in localStorage or sessionStorage.

Run this scanSee pricing

How this scan works

  • Loads the page in headless Chromium (Playwright)
  • Reads localStorage/sessionStorage after load, and again after a short idle for async hydration
  • Regex-matches JWT shape and common token key names (access_token, refresh_token, session)
  • Flags long-lived tokens in storage as an XSS-exfiltration risk vs. httpOnly cookies

More checks in Vulnerability

SQL Injection ScannerCross-Site Scripting (XSS) ScannerAPI Key Exposure ScannerCORS Misconfiguration ScannerCSRF Protection ScannerAuthentication Flow Scanner