Test password reset flows, session fixation, credential transit over HTTP, and rate-limiting thresholds.
Verifies session token regeneration after login, checks password reset token entropy, and validates sliding window login throttles.
Canonical test payload dispatched during security surface audits.
POST /api/login with 200 consecutive attempts without 429Watch the probe engine test this signature in an isolated sandbox.
Sliding Window Rate Limiter
app.post('/api/login', async (req, res) => { /* no throttle */ });import { rateLimit } from 'express-rate-limit';
app.post('/api/login', rateLimit({ windowMs: 15 * 60 * 1000, max: 5 }), handler);Apply tight sliding-window rate limits on authentication endpoints to prevent credential stuffing.
Copy and paste into your editor to refactor this issue automatically.
Test your public domain specifically for Authentication & Session Hijacking Scanner.
Checks commonly evaluated alongside Authentication & Session Hijacking Scanner during surface discovery.
Detect SQL injection vulnerabilities in your web application before attackers exploit database access.
Find XSS vulnerabilities that could let attackers inject malicious scripts and steal customer sessions.
Detect exposed API keys, private tokens, and cloud secrets in client-side bundles and public responses.
Audit your site across all 41 vectors automatically on every deploy.