If opening inspect element and looking at a website’s served HTML is hacking…

Also from the other end, because of how the filter works, mods using couldn’t see messages the user put, so they’d have been free to do whatever, until caught by either a bot, or moderators not using the frontend.

One of the reasons it was found to begin with was because the db-zer0 instance was on it, and the admin, who was using tesseract, suddenly couldn’t load any posts from the instance at all. As Tesseract presents it as a compatibility issue, they were trying to track down the fault at the time.

Basically, every time you visit the page, it has code that sends 500 * 4 queries to one particular instance, making it load a page from the modlog, do a search, etc.

So everyone visiting the page would suddenly be sending 2000 queries each, and in theory, enough users would DoS the server by overloading it with those requests, rendering it unusable.