Alert 1 to win A series of XSS challenges: here's some unsafe code; exploit it! Shortest code wins.
Zip Quine A ZIP file that contains itself. Best paid code I ever wrote.
Chargen Generate test pages from the URL.
SHA1 collision maker
DNS On-the-fly DNS
Screen Test to quickly check if the resolution is 1:1
Stealing Tokens With Harmony The
ServiceWorker is a problem if you have a 'user content' domain (like Dropbox)
Webkit URLs A tragedy in seven parts (so far)
Safari Reader UXSS A non-hostname-based Safari bug
Complaints to @steike.