SecFathy/xss-specialist
KEV-gated continual-learning XSS specialist with execution-authoritative browser verification
From the publisher
README & documentation
Source previewRead the project’s overview, installation instructions and usage examples. The original README is the source of truth.
Can a small language model become a deep XSS expert through gated continual learning — and can a browser oracle turn its reasoning into evidence-backed, hard-to-fool findings? We built it, measured it honestly, and report the negatives. xss-specialist is a research prototype with two halves. The first is an offline study: can a small (8B) open model be specialized into a deep XSS reasoner using retrieval, LoRA fine-tuning, and a KEV-gated continual-learning pipeline where a frozen decision model (Kev-4B) decides what knowledge is even allowed to reach the weights? The second is a live, authorized assessment system that crawls a target in scope, plans marker-first, non-destructive probes, and confirms XSS with a headless-browser oracle — where execution, not model confidence, is the sole authority for a CONFIRMED finding. The most important results are the honest negatives: a specialist model can fix false positives and execution-context accuracy but cannot solve near-miss…
Read the full README ↗ · Preview checked 2026-10-03T13:11:37.212Z
Inside the original README — Document outline
- xss-specialist
- A Kev-style XSS decision model + an execution-authoritative live assessment system
- Table of contents
- The one-paragraph version
- Why this exists
- Two systems, one repo
- Kev-style XSS decision model
- Headline results
- Live assessment — XSS-LiveBench-v2 (102 cases, final frozen run)
- The ablation that matters: the oracle, not the model, drives quality
- Real-world demo (public sandbox)
- The research: KEV-gated continual learning
Headings are captured from the source. Links open the publisher’s document, not a locally hosted copy.
Links from the README
References supplied by the publisher, not independently verified endorsements. Check the destination before downloading files or entering credentials.
Documentation belongs to its respective authors. A listing is not a grant of reuse or training rights. Confirm the document’s own terms at the source.
What this repository does
KEV-gated continual-learning XSS specialist with execution-authoritative browser verification
Repository facts
- Owner
- SecFathy
- Primary language
- Python
- Stars
- 155
- Forks
- 10
- Open issues + pull requests
- 0
- License
- Not reported — inspect the license file
- Archived
- No
- Default branch
- main
- Created
- 2026-09-27T19:11:33.000Z
- Last push
- 2026-09-28T09:18:40.000Z
Topics and intended use
No topics were included in the latest source metadata.
Review the README for scope, installation, examples and limitations. We do not run repository code or certify it.
Evaluate before installing
Review licensing and dependencies, inspect recent commits and unresolved issues, and test in an isolated environment before production use. Stars and forks alone cannot answer these questions.
Source and freshness
Source: GitHub. Metadata observed 2026-10-03T12:05:37.640Z. Daily imports are snapshots, not real-time monitoring.
Popularity and source listings do not establish security, suitability, licensing rights or benchmark performance.
Related repositories
EbookFoundation/free-programming-books
donnemartin/system-design-primer