>>530952048
He's thinking of the real ones (just me) who have CSRF disabled on ST because it's the most annoying fucking thing good LORD, and then with a solid <form> injection you could maybe get me to accidentally nuke my ST.
>>530951703
Consider adding a CSP to the HTML though.