add finding-xss-in-clients