XSS is a special type of bug bounty report... we[0] get them occasionally, and by-and-large they're easy to fix -- sanitize the input on the way out. What some

XSS is a special type of bug bounty report... we[0] get them occasionally, and by-and-large they're easy to fix -- sanitize the input on the way out. What some HN commenters don't understand here is that XSS is special not because it's particularly nasty (though it can be), but that it can creep in without you knowing. You can be aware of it, but one can still slip in if you're not actively guarding against it while coding. When you have a hundred things on your mind, and a complex model of frontend-backend living in your brain's RAM, it's easy to forget about something like sanitizing the output of user-generated content. It's easy to say AFTER the fact that you should never trust user input... obviously I don't, but they still happen, and I'm thankful every day that pentesters check us for XSS as part of our bug bounty process. XSS vulns happen to a lot of developers, Apple devs included. It definitely should've been caught during a code review process, but the silver lining to all of this is that the fix is actually rather simple... update the site to sanitize the input on the way out. No firmware changes needed to the physical devices themselves. [0] NodeBB.org