Yes, but I don't think you can see them without being logged in. The argument is that it doesn't disable XSS by default. Here is the example video https://twitt

Yes, but I don't think you can see them without being logged in. The argument is that it doesn't disable XSS by default. Here is the example video https://twitter.com/nsjames_/status/1682846144118902788 https://twitter.com/nsjames_/status/1682846144118902788 or hypothetical scenario in text form https://twitter.com/nsjames_/status/1682834706671235072 https://twitter.com/nsjames_/status/1682834706671235072 Responses are mostly negative even though the docs seem to agree. https://twitter.com/gurleen_s_/status/1682815674828111872 https://twitter.com/gurleen_s_/status/1682815674828111872 Commenters say that many frameworks do similar things and that defending against XSS is up to the developer.