npm
cure53/DOMPurify
DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
Apache-2.0Sep 16, 2026 · metrics 2.10.0
All tags
Catalogue tag
#xss
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
40 records
NuGet
aspnetboilerplate/aspnetboilerplate
ASP.NET Boilerplate - Web Application Framework
MITOct 13, 2026 · metrics 2.10.0
npm
asamassekou10/ship-safe
CLI security scanner built for the agentic era. Detects CI/CD misconfigs, agent permission risks, MCP tool injection, hardcoded secrets, and DMCA-flagged AI dependencies.
MITSep 6, 2026 · metrics 2.10.0
crates.io
hahwul/dalfox
🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation.
MITSep 27, 2026 · metrics 2.10.0
Packagist
nette/latte
☕ Latte: the safest & truly intuitive templates for PHP. Engine for those who want the most secure PHP sites.
Custom licenseOct 21, 2026 · metrics 2.10.0
Go
chaitin/SafeLine
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
GPL-3.0Sep 19, 2026 · metrics 2.10.0
npm
humanspeak/svelte-markdown
📝 Markdown and HTML renderer for Svelte 5 — built for streaming AI agent output from Claude Code, ChatGPT, and agentic workflows. XSS-safe defaults, token caching, TypeScript types.
MITSep 10, 2026 · metrics 2.10.0
npm
kkomelin/isomorphic-dompurify
Use DOMPurify on server and client in the same way
MITAug 27, 2026 · metrics 2.10.0
NuGet
mganss/HtmlSanitizer
Cleans HTML to avoid XSS attacks
MITSep 11, 2026 · metrics 2.10.0
crates.io
rust-ammonia/ammonia
Repair and secure untrusted HTML
Apache-2.0Sep 13, 2026 · metrics 2.10.0
Packagist
voku/anti-xss
㊙️ AntiXSS | Protection against Cross-site scripting (XSS) via PHP
MITSep 14, 2026 · metrics 2.10.0
Packagist
MathiasReker/php-svg-optimizer
php-svg-optimizer is a lightweight PHP library designed to optimize, minify, and sanitize SVG files 🖼️✨🛡️
MITOct 21, 2026 · metrics 2.10.0
npm · PyPI
sinewaveai/agent-security-scanner-mcp
Security scanner MCP server for AI coding agents. Prompt injection firewall, package hallucination detection (4.3M+ packages), 1000+ vulnerability rules with AST & taint analysis, auto-fix.
MITOct 9, 2026 · metrics 2.10.0
NuGet · npm
AlbusKavaliro/AntiXss
Inofficial port of https://web.archive.org/web/20180126072328/http://wpl.codeplex.com/ to .NET Standard 2.0
Custom licenseSep 18, 2026 · metrics 2.10.0
crates.io
kerberosmansour/SunLitSecurityLibraries
SunLit Security Libraries: Rust security crates for OWASP-aligned services
Custom licenseSep 14, 2026 · metrics 2.10.0
Packagist
paragonie/csp-builder
Build Content-Security-Policy headers from a JSON file (or build them programmatically)
MITOct 19, 2026 · metrics 2.10.0
crates.io
cloudflare/svg-hush
Make it safe to serve untrusted SVG files
MITSep 17, 2026 · metrics 2.10.0
Packagist
interactivetools-com/SmartArray
PHP arrays whose fields HTML-encode themselves when echoed, with chainable methods for filtering, sorting, and grouping database rows. XSS-safe by default, with SmartString's encoder behind it: at least 2.5x faster than calling htmlspecialchars() yourself.
MITSep 9, 2026 · metrics 2.10.0
Packagist
interactivetools-com/SmartString
PHP strings that HTML-encode themselves on echo, interpolation, and concatenation. XSS-safe by default and at least 3x faster than calling htmlspecialchars() yourself.
MITOct 21, 2026 · metrics 2.10.0
Packagist
interactivetools-com/ZenDB
PHP/MySQL database layer where values only enter SQL through placeholders and every result HTML-encodes itself on output. Within microseconds of raw mysqli + htmlspecialchars().
MITSep 17, 2026 · metrics 2.10.0
npm
leizongmin/js-xss
Sanitize untrusted HTML (to prevent XSS) with a configuration specified by a Whitelist
Custom licenseSep 17, 2026 · metrics 2.10.0
—
Safe3/uusec-waf
Industry-leading free, high-performance, AI and semantic technology Web Application Firewall and API Security Gateway (WAAP) - UUSEC WAF.
BSD-2-ClauseOct 19, 2026 · metrics 2.10.0
Packagist
TYPO3/html-sanitizer
HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values.
MITSep 12, 2026 · metrics 2.10.0
npm
micromark/micromark-extension-gfm-tagfilter
micromark extension to support GFM tagfilter
MITOct 20, 2026 · metrics 2.10.0
npm
NaturalIntelligence/is-unsafe
Zero-dependency, DOM-free, pure predicate for detecting unsafe strings across HTML, XML, SVG, SQL, SHELL, NOSQL, and REGEX contexts
MITAug 27, 2026 · metrics 2.10.0
npm
yuda-lyu/wsemi
A support package for web developer.
MITSep 11, 2026 · metrics 2.10.0
NuGet
Vereyon/HtmlRuleSanitizer
A rule based HTML sanitizer built on top of the HTML Agility pack
MITSep 16, 2026 · metrics 2.10.0
NuGet
dotnetarium/Dotnetarium.Analyzers.SCS
Static code analyzer for .NET (Nuget package) based on Security Code Scan
LGPL-3.0Sep 30, 2026 · metrics 2.10.0
npm
sindresorhus/escape-goat
&🐐; Escape a string for use in HTML or the inverse
MITSep 15, 2026 · metrics 2.10.0
npm
3516634930/Payloader
渗透测试Payload速查平台 | Pentest Payload Quick Reference | XSS/SQLi/SSRF/RCE | React+TypeScript
AGPL-3.0Sep 11, 2026 · metrics 2.10.0