My ESP32 sent <script>alert(1)</script> to my dashboard. Not from a web request. From a temperature sensor. I didn't write that code.

A corrupted sensor payload did. Let me explain how that happened — and why it means most IoT dashboards are one corrupted sensor reading away from a security incident. The Khymera dashboard under