--- title: I built a static XSS playground that runs payloads safely in the browser ---

Most XSS learning resources have a tradeoff. They either explain payloads theoretically without letting you see execution, or they require a deliberately vulnerable backend. I wanted a safer middle ground: a fully static frontend app where payloads can run, but only inside an isolated preview. The core of the project is a sandboxed iframe: iframe title = "Sandboxed XSS payload preview" sandbox = "allow-scripts" srcDoc = { generatedHtml } /> The important detail is what is not allowed. The iframe