another xss test and securitymd

Author: ncase

SECURITY.md

@@ -0,0 +1,11 @@
+Did you find an XSS or similarly bad security issue with Nutshell? If so:
+
+1) Whoops, sorry 😬
+
+2) Please contact me at this email!
+
+![](https://ncase.me/faq/contact.jpg)
+
+And then I will attempt to fix it, eventually.
+
+Thank you!

test/xss-test-victim.html

@@ -12,6 +12,7 @@ <h2>Heading</h2>
 <p>
     Does this test work?
     <a href="xss-test.html#cursed">:cursed</a>.
+    <a href="xss-test.html#linkfail">:also cursed</a>.
 </p>
 
 </body>

test/xss-test.html

@@ -20,5 +20,11 @@ <h2>Test</h2>
     Test!
 </p>
 
+<h2>Link Fail Test Too</h2>
+
+<p>
+    <a href='https://youtu.be/pQ2dI_B_Ycg?t=36"></iframe><img src=x onerror="alert(1)">'>:xss</a>
+</p>
+
 </body>
 </html>