Web Security 3 Reflected XSS in a JSON POST Body (and Why I Almost Ignored It) Sep 6, 2026 That Time a Bank Blocked My Account and Still Handed Me a Token Jun 20, 2026 I Came for RFI, I Left with SSRF + XSS Jun 17, 2026