XSS in a BBCode image parser lets attackers steal the bot JWT and read its private post.

Exploited a misconfigured Caddy reverse proxy via SSRF.