How It Works Scanner Results API
XSS Threat Monitoring

Find XSS vulnerabilities
before attackers do.

Playwright-powered scanner continuously probes your endpoints, classifies threats by severity, and generates actionable remediation steps — in real time.

Scan Output Ready
Enter a URL below to start scanning
● CRITICAL
● HIGH
● MEDIUM
● LOW
● INFO

Scan → Detect → Classify → Alert

Four-stage pipeline runs continuously against your target URLs.

1
🎯

Target Injection

Playwright navigates to your URL and injects 44 XSS payloads into query params, form fields, and visible input elements — simulating real attack patterns.

Playwright URL Params Forms
2
🔍

Evidence Collection

Rule engine analyzes the rendered HTML page for six XSS evidence types: script execution, event handlers, javascript: URIs, DOM clobbering, encoding bypasses, and reflection probes.

DOM Analysis Pattern Match Encoding Check
3

Severity Classification

Findings are classified into five severity tiers (critical → informational) based on exploitability and impact. Critical issues flag direct script execution — the highest risk.

Critical High Medium
4
🔔

Alert + Remediation

Every finding includes a contextual remediation step from OWASP guidelines. Alerts are formatted for console, Slack, or API response — your pipeline, your format.

Console Slack API

Run a scan now

Enter any URL. Results in seconds. No account required.

XSS payload categories

44 payloads across 5 severity tiers — from direct script execution to encoding bypass probes.

Critical 9 payloads

Direct code execution with no mitigation. Scripts run immediately on page load.

<script>alert(1)</script> <img src=x onerror=alert(1)> <svg onload=alert(1)> <iframe src="javascript:alert(1)">
High 10 payloads

Attribute injection and context breakout. Exploitable when user input lands in HTML attributes.

" onfocus=alert(1) autofocus=" "><script>alert(1)</script> javascript:alert(1) <a href="javascript:alert(1)">
Medium 8 payloads

DOM mutation and encoding bypass attempts. Nested tags, styles, and math elements used to evade filters.

<style>@import"javascript:alert(1)"</style> <svg><script>alert(1)</script></svg> "><style></style><img src=x onerror=alert(1)>
Low 7 payloads

Probe payloads indicating potential reflection. Unicode and incomplete script tags signal unencoded output.

%3cscript%3ealert(1)%3c/script%3e "><script>alert(1)</script> <script>prompt(1)</script>
Informational 6 payloads

Template injection and context detection. Identifies template engines and sandboxed contexts.

{{7*7}} ${7*7} TPL_RENDER_7 {{constructor.constructor("alert(1)")()}}

REST API

Programmatic access to scan, findings, and target management.

POST
/api/scan
Trigger a scan against a target URL. Returns findings immediately.
urlstringrequired
namestringoptional
curl -X POST https://vigil-ai-40.polsia.app/api/scan \\
  -H "Content-Type: application/json" \\
  -d '{"url": "https://yoursite.com", "name": "Prod"}'
GET
/api/scan
List all scan targets with last scan status and findings count.
curl https://vigil-ai-40.polsia.app/api/scan
GET
/api/scan/:id/findings
Retrieve all findings for a specific scan target, sorted by severity.
curl https://vigil-ai-40.polsia.app/api/scan/1/findings
GET
/api/health
Service health check. No database dependency — safe for load balancers.
curl https://vigil-ai-40.polsia.app/api/health