Paste an ERB or HTML view. It flags lines where a server-rendered value lands inside a client-side template binding in Vue or Angular, the spot where HTML escaping stops protecting you and a reflected value turns into runnable code.
Runs entirely in your browser.
Your code is never sent anywhere.
:attr="'<%= ... %>'" and v-bind:. Vue runs the value as a JS expression.v-html, rendered as raw HTML.{{ <%= ... %> }}.[property] binding, including [innerHTML].This is a heuristic, not a full parser. It reads only what you paste, so it won't follow a value through a helper, a partial, or a variable assigned earlier, and it doesn't cover Haml, Slim, or React. It can't confirm a real bug, only the dangerous shape.
Treat a clean result as "nothing obvious here", not "proven safe". For coverage across a codebase, use a static rule (Semgrep) or a DOM-driven scan. A standard Rails scanner like Brakeman won't catch this class at all.