Web-Security

HTMX is great at making server-rendered apps feel fast without dragging in a giant frontend stack. I like it for exactly that reason. You keep your templates, keep your backend routing, and sprinkle interactivity where you need it. The catch: HTMX is built around fetching HTML and swapping it into the DOM. That’s the same territory where XSS thrives. If your app sends attacker-controlled HTML back to the browser, HTMX will happily insert it. That doesn’t make HTMX uniquely insecure. It just means the trust boundary is very clear: HTMX amplifies whatever your server returns. ...

Cross-site scripting gets most of the attention, but SVG-based attacks keep showing up in bug bounty reports, file upload flaws, and chat apps that “support rich images.” If you build web apps, you should treat SVG as part image, part document, part script container, and part footgun. The tricky part is that XSS and SVG attacks are not competing categories. SVG attacks often become XSS. That overlap is exactly why teams underestimate them. ...

If you embed a chat widget, you’re adding a third-party UI surface that touches user-controlled data: names, emails, pre-chat forms, custom variables, URLs, campaign tags, support messages, and sometimes your own CRM content. That makes LiveChat-style widgets a classic XSS boundary. The main rule is simple: treat everything that enters or leaves the widget as untrusted. This guide focuses on the places developers usually get burned when integrating a LiveChat widget and shows safer patterns you can paste into real code. ...

Angular gives you better XSS defaults than most frontend frameworks. That’s the good news. The bad news: teams still break those protections all the time. I’ve seen this happen in real apps that started out safe, then picked up “just one quick workaround” for rich text, embeds, markdown, or dynamic links. A few months later, the app is full of bypassSecurityTrustHtml, direct innerHTML writes, and helper pipes that quietly turn untrusted input into executable code. ...

WeChat mini-programs look like web apps, smell like web apps, and absolutely still give teams a false sense of security around XSS. I’ve seen this mistake a lot: a team assumes “it’s not running in a normal browser, so classic XSS doesn’t really apply.” That’s the wrong mental model. The attack surface is different, the rendering model is more constrained, and some browser features are missing, but untrusted data is still untrusted data. If your mini-program renders attacker-controlled content, builds templates carelessly, or bridges unsafe data into native-like APIs, you can still end up with script injection, UI redress issues, data theft, or malicious action execution. ...

WKWebView is one of those APIs that looks harmless until you ship a hybrid app, load a little untrusted HTML, and accidentally hand JavaScript access to native code. That’s where XSS in iOS apps gets ugly. Browser XSS is already bad. XSS inside WKWebView can be worse because the payload may not stop at stealing cookies or rewriting the DOM. If your app exposes native functionality through WKScriptMessageHandler, custom URL schemes, or sloppy navigation delegates, injected JavaScript can start poking at app internals. ...

Browser extensions are one of the weirdest XSS threat sources because the vulnerable code often isn’t yours. Your app can have solid output encoding, a decent CSP, and disciplined frontend code, then a user installs an extension that injects scripts, mutates the DOM, rewrites requests, or shoves untrusted HTML into your page. Suddenly your clean security model gets dragged into someone else’s mess. For developers, the hard part is that extension-driven XSS sits in an uncomfortable middle ground: ...

Cross-site scripting is still one of the easiest ways to turn a tiny frontend mistake into a full account takeover. I’ve seen teams spend weeks hardening auth flows while leaving a innerHTML assignment sitting in a comment widget like a loaded gun. The tricky part is that “XSS payloads” are not all the same. Some rely on raw <script> injection. Some abuse HTML attributes. Some hide inside JavaScript URLs, SVG, Markdown, or template rendering. If you only block one shape, the others get through. ...

Budibase makes it easy to ship internal tools fast. That speed is great for product teams and terrible for security if nobody stops to ask a basic question: where does this data come from, and how is it rendered? That question matters because XSS in Budibase apps usually does not come from some dramatic “hacker-only” feature. It comes from normal app-building behavior: user-generated content, dynamic bindings, custom components, markdown-ish fields, embedded HTML, and API data that gets trusted too early. ...

SurveyMonkey feels harmless because it’s “just forms.” That mindset gets teams into trouble. I’ve seen developers lock down their main app, then casually embed survey content, pipe responses into dashboards, send answers into admin panels, and render “custom thank you” pages with basically no output encoding. That’s how XSS sneaks in: not through the survey vendor itself, but through the glue code around it. If you use SurveyMonkey in a website, a customer portal, or an internal reporting tool, the risky parts are usually: ...