thanks for the xss report