Hacker News Reader

Does XSS in the description hurt? There's nothing to steal from the /project page and it's not displayed in /admin.

Do you really want someone to inject some js that says "click here to receive notifications about this project" that actually sends them spam notifications?

Fixed, thanks! Also urls get hyperlinked now.

Reply on news.ycombinator.com