3 ms·

This was a bug and it has been fixed. We do not consider CRSF attacks to be a feature. This is completely different from allowing legit users to post HTML/JS fr

by dhh 17y ago

This was a bug and it has been fixed. We do not consider CRSF attacks to be a feature. This is completely different from allowing legit users to post HTML/JS from inside the application. We now also have a dedicated email address and public key for reporting any similar issues. See http://37signals.com/security http://37signals.com/security.