2021-01-11 UTC
# 
[schmarty] the reports are often... technically correct. like yeah it shouldn't be possible to stick javascript in the query string and have it execute on the page but it's also unlikely to lead to leaking anyone's auth tokens.