PreFlight catches security issues. This is where we explain them — the patterns we look for, the real-world incidents behind the threat-intel, and the architecture shapes that shape (or break) your security posture. Read once, build safer forever.
Breakers
Breakers are the concrete adversarial inputs paired with each finding. When you expand a finding, you see what an attacker would type or upload to exploit it. 25 entries across 15 probe classes, growing as new probes ship.
Static-only safety contract
Every Breaker entry is a string. We render it; we never execute it.
PreFlight does not send the payload anywhere. The Copy button writes to your clipboard only when you click it.
No payload references a real production hostname; placeholders only (example.com, attacker.example).
No payload includes a real credential, token, or working exploit against a named third party.
The contract is enforced by tests under src/test/breakers.test.js: payload-only, anonymized hosts, no credential-shaped values.
Use these on systems you own or have explicit authorization to test. Replaying these against systems you do not own is unauthorized access in most jurisdictions. Breakers exist to help you reproduce a finding in a dev environment so you can confirm the fix, not as a how-to for hitting somebody else.
Coverage by probe
Each probe listed below has one or more Breaker entries shown alongside its findings on the scan page. Click a probe name to open the matching pattern explainer.
Data lives in src/lib/breakers.js; the contract is enforced by src/test/breakers.test.js. Breakers v1 ships on the feature/breakers-v1 branch; v1 is static-only by design. A DAST-style execution surface is explicitly out of scope.