While it doesn't look good, it doesn't inject or execute scripts.
Still, would have liked an official take on this. I was about to re-signup but now I'll hold off on that.
Still, would have liked an official take on this. I was about to re-signup but now I'll hold off on that.
Admittedly, no full XSS anymore, but still dangerous and shows their lack of understanding and caring about security.
It's not the only place you can inject HTML and not every page has a CSP...