Run simulated malicious scripts to test TokenGuard's prototype locks and exfiltration prevention. Tests 1-2 run same-origin (inline script on this page, like a classic XSS payload) — TokenGuard's storage guard only blocks cross-origin callers reaching into Storage/cookies (it can't tell a same-origin injected script apart from the page's own code by origin alone), so these are expected to log as audited-but-not-blocked. Tests 3-4 target a genuinely different domain, so they exercise the exfiltration guard, which blocks regardless of the calling script's origin — these are expected to actually fail/throw.
Simulates a same-origin script setting and harvesting a JWT token in localStorage. Expected: write succeeds (not blocked — see note above); check the popup's Security Feed for an audit entry only if this were cross-origin.
Simulates a same-origin XSS payload writing a sensitive session cookie. Expected: write succeeds (same same-origin caveat as Test 1).
Simulates sending a JWT via fetch() Authorization header to unauthorized domain evil-analytics.com. Expected: request is blocked/rejected, and the popup's Security Feed shows an EXFILTRATION_BLOCKED entry.
Simulates XHR exfiltration with Bearer token to evil-tracker.com. Expected: blocked/throws, logged the same as Test 3.