lmao there's an XSS popup on the main page