# Netflix-Skunkworks/sleepy-puppy

Sleepy Puppy XSS Payload Management Framework

Repository: https://github.com/Netflix-Skunkworks/sleepy-puppy
Canonical: https://ross.abutalabs.com/products/sleepy-puppy
Language: JavaScript
License: Apache-2.0
License Family: permissive
Topics: security
Last push: 2018-07-24T20:33:09+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 4027, "days_push": 2962, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1044, forks 138 (observed 2026-08-28T04:03:21.167072+00:00)

## What it is
Sleepy Puppy is a cross-site scripting (XSS) payload management framework from Netflix Skunkworks that captures, manages, and tracks XSS payload propagation across applications over time. It provides customizable payloads, PuppyScripts, and collectors that report back when and where injected payloads execute, even long after the initial test.

## Use cases
- track delayed XSS payload execution across applications
- capture screenshots and DOM context when an XSS payload fires
- manage and organize XSS payloads by assessment
- get email notifications when an injected payload executes
- trace cross-application XSS propagation during penetration tests
- integrate XSS payload tracking with Burp or ZAP via API

## When to choose
- you need to detect XSS payloads firing in applications other than the one under test
- you want long-term tracking of client-side injection execution with rich capture metadata
- you need email alerts when delayed XSS events occur

## When to avoid
- you need an actively maintained tool - the project was deprecated in July 2018
- you only need simple, immediate XSS scanning rather than payload propagation tracking
- you cannot self-host a Python/JavaScript web application

## Facets
- artifact type: application
- maturity: abandoned
- function: security, web-framework, http-server, api-framework
- domain: security, web-development, penetration-testing
- platform: python
- tags: xss, payload-management, penetration-testing, deprecated, web-server, javascript

## Member repositories
- Netflix-Skunkworks/sleepy-puppy (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:21.167072+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:02:11.069203+00:00, confidence not recorded.
  - readme: https://github.com/Netflix-Skunkworks/sleepy-puppy (fetched 2026-08-28T04:03:21.167072+00:00, sha 2bfdc1886e0d)
- Data as of 2026-08-30T08:39:29.467469+00:00.