Detect JWTs, refresh tokens, and session identifiers stored in localStorage or sessionStorage.
Browser-readable storage is a risky place for long-lived authentication tokens. This scanner analyzes HTML and same-origin JavaScript bundles for token-like keys stored in localStorage or sessionStorage, including Supabase session persistence patterns.
Fetches public pages and same-origin script bundles without executing JavaScript. Searches for token-like localStorage/sessionStorage usage and flags access tokens, refresh tokens, JWTs, and persistent Supabase session storage.
One XSS flaw or compromised third-party script can read localStorage and sessionStorage. If refresh tokens live there, a short script injection can turn into durable account takeover.
Get a full security report with remediation guidance in 30 seconds. No setup required.
Find XSS vulnerabilities that could let attackers inject malicious scripts into your pages.
Configuration AuditAudit cookie flags, session management, and token security for your application.
Vulnerability DetectionAnalyze JSON Web Tokens for weak algorithms, key exposure, and implementation flaws.