@mint @dcc It's like saying XSS on it's own isn't a vulnerability unless you actually use it to steal credentials. It's not an attack in its entirety, but it's an element of an attack, so definitively a vulnerability. If this were on Mastodon it would be assigned a CVE.