Wait, wasn't the initial XSS problem that their serialization of strings didn't escape `\` properly?