You’re the one speculating. You can analyze your network traffic to ensure it disabled, and as people have done and verified that it is disabled. Those are standard Google Ad trackers. Any app with ads has them, like Sync for Reddit did and Sync for Lemmy does.

Used to work with a guy who would put 3 second sleeps after every line in our Jenkins file. He would then say how he’s so busy because he has no time when he’s always waiting for builds to run.

Chris, everyone knows what you were doing.

I’m offended you think I’m 14

If there’s truly XSS vulnerabilities in lemmy that would be really bad. It’s one of the first things an attacker will try and it’s so easy to protect against.

Or when you hit an API and the error message comes back as html instead of json.