Hacker News Reader

This is exactly why I posted here. Thank you so much for this feedback. Will fix and let you know.

Your laravel php framework debug messages are being exposed to users.

Cool site tho, Have a lovely week.

This issue now resolved.

To clarify, why is being able to display an alert a massive security flaw in this context?

The alert itself is harmless, but demonstrates that arbitrary javascript - which could certainly not be harmless - can be injected into the page.

It's not the ability to display alerts that is concerning, but rather, the ability to run untrusted Javascript. This was a proof of concept that showed that it has a serious XSS vulnerability

For detailed information on what XSS is, how it can be exploited and prevented have a look at the OWASP XSS description

https://owasp.org/www-community/attacks/xss

This is now resolved. Thanks for the feedback!

ISSUE RESOLVED