Local payload collections are boring. That is why they matter

The most annoying part of XSS testing is not finding the first working payload.

It is finding it again.

The tester changes one encoding step, tweaks a placeholder, tries a different quote strategy, clears the tab, then realizes the original string was the useful one. Now the report contains a half-remembered payload and a vague note about "double encoding."

Local collections fix a boring workflow problem.

Reproducibility beats memory

A payload is more than its final string. It has context: target parameter, parser context, blocked tokens, encodings, mutations, and why the operator tried it. If the tool only exposes a copy button, that context disappears.

A useful saved item should preserve enough detail to answer practical questions later:

{
  "templateId": "dom-innerhtml",
  "payload": "<img src=x onerror=alert(1)>",
  "context": "dom",
  "notes": "q parameter reaches preview.innerHTML after URL decode"
}

That is not glamorous. It is the difference between a report that can be validated and a screenshot nobody trusts.

Local storage is a tradeoff

Keeping collections client-side avoids sending testing material to a backend. Good. It also means the data lives in the browser profile. A shared workstation, browser sync, or careless export can still leak it.

So the product should make exports explicit. No hidden sync. No surprise account feature. No telemetry pretending to be convenience.

For a security tool, boring local JSON is often the right primitive.

Regression testing with payload sets

Collections also help after the bug is fixed. Save the payload that worked, the variants that were blocked, and the final proof path. When the developer ships a patch, replay the same set.

You are not trying to prove that every XSS is gone. You are checking whether the exact vulnerable behavior changed.

That is a narrower and more honest test.

Import needs guardrails

Importing collections sounds harmless until a malformed JSON file overwrites existing data or creates thousands of entries. Schema validation matters. Size limits matter. IDs should not be trusted blindly.

If an imported collection has the same ID as an existing one, the safe behavior is to create a new local ID unless the user explicitly asked for replacement. Silent overwrite is a bad default.

Security tools accumulate strange data. Design for that.