Bug bounty write-up: XXE bug leading to LFI | Hacker News Reader