Detect sensitive tokens, passwords, or PII stored in unencrypted localStorage or sessionStorage.
Parses client bundles to detect storage of access_token, user credentials, or unmasked credit card details in browser web storage.
Canonical test payload dispatched during security surface audits.
localStorage.setItem('auth_token', jwt)Watch the probe engine test this signature in an isolated sandbox.
HttpOnly Cookie Storage
localStorage.setItem('session_token', token);cookies().set('session_token', token, { httpOnly: true, secure: true, sameSite: 'lax' });Store session tokens in HttpOnly cookies so they cannot be accessed or extracted via JavaScript XSS attacks.
Copy and paste into your editor to refactor this issue automatically.
Test your public domain specifically for Client-Side Browser Storage Leak Scanner.
Checks commonly evaluated alongside Client-Side Browser Storage Leak Scanner during surface discovery.
Detect SQL injection vulnerabilities in your web application before attackers exploit database access.
Find XSS vulnerabilities that could let attackers inject malicious scripts and steal customer sessions.
Detect exposed API keys, private tokens, and cloud secrets in client-side bundles and public responses.
Audit your site across all 41 vectors automatically on every deploy.