Escape sitename on install HackerOne Report 24062