Alert 1 to win A series of XSS challenges: here's some unsafe code; exploit it! Shortest code wins.
Zip Quine A ZIP file that contains itself. Best paid code I ever wrote.
Chargen Generate test pages from the URL.
DNS On-the-fly DNS
Stealing Tokens With Harmony The
ServiceWorker is a problem if you have a 'user content' domain. It could be used to steal files from Dropbox.
Complaints to @steike.