songjianyang/xss-audit
Static XSS audit skill with 14 layers of checks for React, TypeScript, and JavaScript projects.
From the publisher
README & documentation
Source previewRead the project’s overview, installation instructions and usage examples. The original README is the source of truth.
Comprehensive XSS vulnerability detection skill with 14 layers of checks for React/TypeScript/JavaScript codebases (static audit). Use when the user wants an in-depth XSS audit with broad static coverage, including SVG, MathML, CSS injection, markdown pipelines, mXSS/sanitizer bypass, JSON-in-script injection, URL validation bypass, and Trusted Types analysis. Outputs report to xss-audit-report.md. This skill comes from my hands-on work in real-world bug bounty programs. Over the course of one year, I used it in my day-to-day audit workflow and refined it continuously based on what worked and what missed. That workflow helped me identify dozens of XSS vulnerabilities that were awarded bounties. During the same period, I was ranked in Microsoft's MSRC Security Researcher Leaderboard (quarterly Top 10) for four consecutive quarters — 2025 Q3 #4, Q4 #7, 2026 Q1 #6, Q2 #10 (leaderboard, my profile). I'm sharing it so others can adapt the same review process to their own audits. Copy…
Read the full README ↗ · Preview checked 2026-10-30T23:54:05.736Z
Inside the original README — Document outline
Headings are captured from the source. Links open the publisher’s document, not a locally hosted copy.
Links from the README
References supplied by the publisher, not independently verified endorsements. Check the destination before downloading files or entering credentials.
Documentation belongs to its respective authors. Reported project/model license: MIT. A listing is not a grant of reuse or training rights. Confirm the document’s own terms at the source.
What this repository does
Static XSS audit skill with 14 layers of checks for React, TypeScript, and JavaScript projects.
Repository facts
- Owner
- songjianyang
- Primary language
- Not reported
- Stars
- 544
- Forks
- 147
- Open issues + pull requests
- 0
- License
- MIT
- Archived
- No
- Default branch
- main
- Created
- 2026-10-24T11:32:36.000Z
- Last push
- 2026-10-24T11:32:55.000Z
Topics and intended use
No topics were included in the latest source metadata.
Review the README for scope, installation, examples and limitations. We do not run repository code or certify it.
Evaluate before installing
Review licensing and dependencies, inspect recent commits and unresolved issues, and test in an isolated environment before production use. Stars and forks alone cannot answer these questions.
Source and freshness
Source: GitHub. Metadata observed 2026-10-31T12:17:23.005Z. Daily imports are snapshots, not real-time monitoring.
Popularity and source listings do not establish security, suitability, licensing rights or benchmark performance.