PROJECT · LIVE

Webpage Vulnerability Scanner

A lightweight security auditing script that fetches a target webpage's HTML and scans it for three common front-end vulnerability classes: hardcoded API keys or cloud config (such as Firebase credentials left exposed in client-side JS), unsafe DOM manipulation patterns that can open the door to Cross-Site Scripting (XSS), and authentication logic that only lives in client-side JavaScript instead of being enforced by the backend. Each finding is printed with a plain-language remediation tip, so the tool works as a quick first-pass audit as well as a learning aid for spotting these mistakes before they ship. Key features: - Fetches live HTML from a target URL over HTTPS - Regex-based detection of exposed Firebase/API configuration values - Flags risky .innerHTML usage tied to dynamic or untrusted content - Detects client-side-only admin auth gating (hiding elements with CSS instead of real backend checks) - Structured, readable vulnerability report printed to the terminal