dbielik

The top 20 domains are interesting in that they use hundreds of unique payment links (buy.stripe.com) - it really shows the value in Stripe's investment in No-Code features.

Here are 240 sites (as of today):

https://www.nerdydata.com/reports/fast/72951386-2c5a-4372-9c...

Fun game!

I'd suggest adding a link to the shareable clipboard score.

Still at least two sites [1] actively exploited on https://www.newbalance.com.hk/zh/checkout/cart/ and https://www.clear4vision.com/checkout/cart/ if you view-source

[1]: https://www.nerdydata.com/reports/cloud-iq-net/b9f4d0cc-a686...

Doesn't look isolated to Twilio - seems to be on 85 websites via other affected 3rd party scripts: https://www.nerdydata.com/reports/gold-platinumus-top-track/...

Could be nice to add a message on desktop saying the site only works on mobile! I was confused at first asking for feedback when there was nothing to click on the desktop site.

Related: https://www.bloomberg.com/news/features/2018-06-26/how-to-st...

There was once a bookmarklet to explore and preview Optimizely experiments: https://growthhackers.com/questions/show-gh-spy-on-optimizel...

Try https://nerdydata.com - lets you search by source code also

Yes, they still do depending on how you redirect (i.e. unsanitized: location.href = url).

A nice benefit of using a framework like angular, Vue, react, etc, is that they prevent attacks like this unless you explicitly disable those features.

Nerdydata.com offers this level of custom rendering and crawling! (Minus the visual part, if that's nice-to-have and not a requirement)

The visualizations in this article are excellent!

> This app has access to: Device & app history Allows the app to view one or more of: information about activity on the device, which apps are running, browsing history and bookmarks

Why is this required?

Actions express priorities

This was an idea from the show "Nathan For You"!

I agree, and they've also built this themselves for people who don't know how to embed/integrate it.

Stripe recently launched this feature themselves! https://stripe.com/us/billing

You can set up subscriptions/invoices and send a stripe-hosted link (pay.stripe.com) for the customer to enter their billing.

And you don't need to do _any_ coding. So, I'm not sure what the benefit of this is over using Stripe directly. Am I missing something?

Make sure any session/auth cookies are httpOnly too!

Why not create a Facebook or Google account just for these websites? Or is it the cross domain tracking that is worrying since everyone's sites are tagged?

Webpage not available The webpage at http://readvee.com/ could not be loaded because:

net::ERR_NAME_NOT_RESOLVED

It's just something we wanted to use, so we made it ;)

Thanks! Great advice!

Guests have access to the top 10 results, but depending on how common the code you search for is, you may get less than 10. We usually see millions of results for more common terms. What was your search out of curiosity? Thanks for the comments, keep 'em coming!

Absolutely! Any snippet of source code can easily be searched... for example, "jquery.min.js": https://search.nerdydata.com/search/#!/searchTerm=jquery.min...