For five minutes, it worked beautifully, identifying cross-site scripting flaws and SQL injections. Then, the fans on his laptop began to scream.