When “Safe” Isn’t Safe: Turning a Simple HTML Injection into a Real Security Story.

In bug bounty hunting, not every vulnerability needs flashy payloads or JavaScript execution to matter. Sometimes, the simplest flaws —…