I like to say "The capabilities of attackers are not bounded by your imagination." It is possible to get a "security bug" that is technically a security bug, b

I like to say "The capabilities of attackers are not bounded by your imagination." It is possible to get a "security bug" that is technically a security bug, but still isn't really all that important. But you generally want to be very careful in making that assessment, because just because one particular person, even someone fairly skilled in security, doesn't think it can be used to do anything truly harmful doesn't mean that the attackers won't figure something out. XSS has been a particular rich source of this; it's very easy for someone not too up on security to say "Oh, whoopdedo, it lets you pop up an alert box or change the client side display", when in fact XSS can steal login cookies if you haven't properly secured them (which seems likely to correlate highly with people who don't think XSS is a big problem) and be used to proxy web connections to other resources in the context of the user, conforming to the same-origin policy [1]. So, for instance, with the recent story about a guy finding an XSS in Tesla's service management page, they were correct to respond to that as a serious issue; it wasn't just a way of moderately inconveniencing a service tech, it was a back door into their entire service system, potentially. XSS has a huge mismatch between the general developer's impression of its severity and its actual severity. [1]: https://github.com/beefproject/beef/wiki/Tunneling https://github.com/beefproject/beef/wiki/Tunneling