https://stream.echo6.co/videos/watch/5d06b08b-5825-4496-9db2-4a7c1bdf97f9 ... and use alert(document.domain) or alert(window.origin) instead. Blog post: https://liveoverflow.com/do-not-use-alert-1-in-xss/ Sponsored by Google for their Bug Hunter University: https://bughunters.google.com/learn/invalid-reports/web-platform/xss/5108550411747328 00:00 - Intro 00:47 - Why Do We Use Alert(1) for XSS? 02:25 - alert(1) Popup is NOT Proof of a Vulnerability! 03:07 - Invalid XSS Example 1 on Blogger 04:43 - Sandbox Subdomains 06:27 - Sandboxed iframes 08:29 - Invalid XSS Example 2 on Google Sites 09:50 - Why Should You Care About Invalid XSS Issues? 10:55 - Summary 11:55 - Outro -=[ ❤️ Support ]=- → per Video: https://www.patreon.com/join/liveoverflow → per Month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join -=[ 🐕 Social ]=- → Twitter: https://twitter.com/LiveOverflow/ → Website: https://liveoverflow.com/ → Subreddit: https://www.reddit.com/r/LiveOverflow/ → Facebook: https://www.facebook.com/LiveOverflow/ Wed, 15 Apr 2026 14:16:45 GMT https://validator.w3.org/feed/docs/rss2.html PeerTube - https://stream.echo6.co https://stream.echo6.co/client/assets/images/icons/icon-512x512.png https://stream.echo6.co/videos/watch/5d06b08b-5825-4496-9db2-4a7c1bdf97f9 All rights reserved, unless otherwise specified in the terms specified at https://stream.echo6.co/about and potential licenses granted by each content's rightholder.