Claude CodeAnchorr: Stored XSS in User Mapping dropdown allows unprivileged Discord users to exfiltrate all secrets via /api/config
How AI Introduced This
Yes. AI-authored commit 403ccf079be0ee5e6660f0ed2fa64174d76eff2f (Claude Code) directly introduced the vulnerable Discord user-mapping dropdown by rendering Discord-controlled member fields with `innerHTML` in `web/script.js`. A separate earlier non-AI dashboard commit exposed raw configuration secrets to browser-side JavaScript, which made that AI-authored XSS sink capable of exfiltrating secrets via `/api/config`.
▶Attribution Chain
▶Bug-Introducing Commits(2)
Deep Verification
by investigator-overrideYes. AI-authored commit 403ccf079be0ee5e6660f0ed2fa64174d76eff2f (Claude Code) directly introduced the vulnerable Discord user-mapping dropdown by rendering Discord-controlled member fields with `innerHTML` in `web/script.js`. A separate earlier non-AI dashboard commit exposed raw configuration secrets to browser-side JavaScript, which made that AI-authored XSS sink capable of exfiltrating secrets via `/api/config`.