We recently on-boarded someone else's code which has since been tested, and failed, for DOM XSS at