3 ms·

The actual app is pretty well xss proofed. But, unfortunately if you go to this link... http://twich.me/<script>alert(document.cookie);</script> (had to

by zepolen 16y ago

The actual app is pretty well xss proofed. But, unfortunately if you go to this link... http://twich.me/<script>alert(document.cookie);</script> (had to stick it in code block because HN auto marks it as spam)

jerf 16y ago
Ah, alas, I stand corrected. That's a 10-second one. I didn't do much more than a 10-second pass, that's usually sufficient.
- zepolen 16y ago
  Unfortunately there was also another one in the youtube embedding feature, took half an hour to find :)