@p @J @f5b55f6b44b8997b2b6e8469a6a57f8d3f3b2ef27023543445c40ecec485ee64 @NonPlayableClown @Zergling_man

>Probably worth noting that he shat on Pleroma for this:
He also made a thread claiming Pleroma FE was vulnerable to XSS when the purpose built parser misparsed URL encoded utf-8 characters. If I remember I was able to reproduce it, but I wasn't able to turn it into something usable that would break the FE or inject code.