News for hackers. Stuff that matters.

A comment on Sourcehut account takeover via build logs (XSS in ansi2html).

Re:Sourcehut account takeover via build logs (XSS in ansi2html) by JamesCoyne on Thursday September 24, 2026 @04:55PM (#49836611)
Really commendable work fixing up the upstream python project. I don't think there's anything to be embarrassed about in the timeline.
[ Parent | on HN ]
Re:Sourcehut account takeover via build logs (XSS in ansi2html) by arusekk on Thursday September 24, 2026 @06:57PM (#49837924)
I would prefer to do a super proper disclosure with coordinated release dates and everything. My first submitting to SourceHut security ML ended up making the vuln existence somewhat public before upstream ever knew.
[ Parent | on HN ]