Here's the direct link to the report: https://medium.com/@Zemnmez/how-to-hack-the-uk-tax-system-i-guess-3e84b70f8b https://medium.com/@Zemnmez/how-to-hack-the-u

Here's the direct link to the report: https://medium.com/@Zemnmez/how-to-hack-the-uk-tax-system-i-guess-3e84b70f8b https://medium.com/@Zemnmez/how-to-hack-the-uk-tax-system-i-... It's a neat write-up - the security folks at Twitch do some great work and this is no exception. Seems like HMRC really need to work on a responsible disclosure system of some sort, I'm surprised that there are no security@ emails. I'm also left wondering if Content-Security-Policy could have helped with that XSS.