See browser security
in action
Real attack scenarios. Real browser security headers. Watch how modern web security features detect, block, and report threats — all powered by Report URI.
Choose a demo
Each demo shows a real attack or browser behaviour — first unprotected, then with the appropriate security header in place.
Four attack scenarios showing how CSP prevents script injection, Magecart skimmers, form hijacking, and XSS — with live violation reports.
See how the 'report-sha256' CSP keyword sends the hash
of every loaded script to Report URI — giving you cryptographic proof
of exactly what code ran on your page.
See how Integrity-Policy makes SRI mandatory — blocking any script
loaded without an integrity attribute and reporting the
violation to Report URI.
See how Permissions Policy restricts access to powerful browser features like camera, microphone and geolocation — and reports any attempts to use them.
Watch the browser automatically report DNS failures, connection errors, and broken requests — without any JavaScript required.
Cross-Origin Embedder Policy and Cross-Origin Opener Policy isolate your page from untrusted cross-origin content, protecting against Spectre-style side-channel attacks.
Discover deprecated API usage in production — in real user sessions — without instrumenting your code. The browser reports it automatically.
See when the browser silently overrides your code to protect users —
such as ignoring preventDefault() on passive scroll listeners.
The browser reports tab crashes, out-of-memory events, and unresponsive pages automatically — no JavaScript required, even when the tab is dead.
How it works
Every violation report generated by these demos is sent live to a Report URI account.
Trigger a violation
Each demo loads content or runs code that a security header would block.
Browser blocks it
Switch to protected mode and the security header stops the attack — shown live on screen.
Report URI logs it
The browser sends a violation report to Report URI, giving you full visibility of every blocked attempt.
Get notified
Report URI alerts you to new threats via email, Slack, or webhooks so you can act fast.