CheckVibeCodeCheckVibeCode
Checks/Vulnerability
VulnerabilityHeuristic5 checks

Cross-Site Scripting (XSS) Scanner

Find XSS vulnerabilities that could let attackers inject malicious scripts into your pages.

Run this scanSee pricing

How this scan works

  • Reflect an inert, uniquely-tagged marker string into each discovered param
  • Check whether the marker comes back unescaped in an HTML-executable context (raw <, event handler, javascript: URL)
  • Check for a Content-Security-Policy that would mitigate reflected XSS even if a sink exists
  • Check the legacy X-XSS-Protection header (informational only — a deprecated control)
  • Flag DOM sinks visible in inline <script> (innerHTML, document.write, eval) as manual-review candidates

More checks in Vulnerability

SQL Injection ScannerAPI Key Exposure ScannerCORS Misconfiguration ScannerCSRF Protection ScannerAuthentication Flow ScannerOpen Redirect Scanner