Just got like three 0 sats zaps in a row whenever I posted my Word5 score. The description was just all raw code when I saw it. However, if it did execute you might not see anything at all. Based on its target, I assume it would only actually work if I were on Primal via web browser upon seeing the zap, but what do I know. According to my AI: “for this attack to work, the malicious JavaScript would need to actually execute on your device, within the app's environment. That's the fundamental requirement of XSS. Here's why you're very likely fine in this case: You saw raw code as text. That means Wisp escaped or sanitized the HTML — it treated the zap description as plain text rather than parsing it as HTML/JavaScript. The <div> tags were displayed to you as literal characters, not rendered as DOM elements. If the code had actually executed, you'd typically see nothing unusual — the divs would be invisible elements in the DOM and the JavaScript would run silently in the background. The fact that you can read the attack code is actually your strongest signal that it didn't run.”