I identified a potential security vulnerability on your website. I did not exploit it beyond proof-of-concept. I’m reporting this responsibly so it can be fixed.