I am getting an `alert(1)` when visiting this site. This smells like cross-site scripting. Beware.