Group
  • Security

    Prevent stored XSS in user-generated content

    Escapes or sanitizes user content at render time and audits every place raw HTML is injected into the page.

    • Improve quality
    • Debug & fix
    • Intermediate
    • Cursor
    • General

Free Prompt

Audit my app for stored XSS vulnerabilities. Find every place user-generated content (profiles, comments, posts, usernames, bios, uploaded titles) is rendered back into a page. For each location, check how the content is inserted into the HTML. Flag any use of raw HTML injection (innerHTML, dangerouslySetInnerHTML, unescaped template output, string concatenation into markup) and replace it with escaped output by default. Where the app genuinely needs to render user-provided HTML (like a rich text editor), sanitize it with an established allowlist-based sanitizer and strip script tags, event handler attributes, and javascript: URLs. Do not strip formatting users legitimately need if a rich text feature exists. Do not sanitize only on input and assume that's enough; output encoding at render time is the requirement. Do not write your own regex-based sanitizer. Show me every render location you audited, what was vulnerable, and the fix applied. End with a verification payload list: a few standard XSS test strings (like a script tag in a comment field) I can paste into the app to confirm they render as inert text.

What This Does / How This Helps

Hunts down every spot where user content gets rendered and makes sure it's escaped or sanitized, so one user's input can't run as JavaScript in another user's browser. Stored XSS is the classic vibe-coded app hole: a comment box or profile field that renders raw HTML. An attacker saves a script as their bio, and every visitor who views their profile runs it with their own session. That's account theft without ever touching your server. Expect a full audit of render locations, fixes applied with proper escaping or an allowlist sanitizer, and test payloads to paste in and confirm they render as harmless text.

Want to skip doing this by hand?

Fortivibe audits your app for all of the areas these prompts cover (and more).

See What We Check

Related Prompts