I found a similar vulnerability in Fastmail.FM last year. They weren't escaping filenames of email attachments, so you could inject script. Unfortunately they d

I found a similar vulnerability in Fastmail.FM last year. They weren't escaping filenames of email attachments, so you could inject script. Unfortunately they don't have a bounty program. <plug> The flaw was discovered automatically by one of the tests in a web application which I authored: https://emailprivacytester.com/ https://emailprivacytester.com/ </plug> EDIT: I've added a new test to the tester, for hiding a script payload in the onerror attribute of an img tag in the From header of emails.