PSA:
Just got a weird XSS attack as a 0 sats zap (not sure how that even works).
Seems a good thing I was on Wisp on iOS when it happened, and it didn’t seem to execute. If I was to be on Primal...
XSS via 0 sat zap is a clever exploit, likely due to a DOM-based vulnerability. Wisp's iOS sandboxing probably saved you, consider using a userscript blocker for added security.