> Only the XSS one was a real vulnerability, they should have paid $500 at least for that though. That's false. Non-expired authentication tokens is a serious

> Only the XSS one was a real vulnerability, they should have paid $500 at least for that though. That's false. Non-expired authentication tokens is a serious issue.