DOM XSS to Account Takeover: Not-So-Dirty Dancing in GIS SDK

Dec 7, 2025 · 10 min read · It was just another bug hunting session on a public program. The scope wasn't huge - only a couple of domains to work with - but that's often where you find the best bugs. I had been grinding on this