Exfiltrated Tokens

Nothing received yet. POST a comment with an XSS payload that calls /steal?c= + the cookie value, then visit /mod-preview.