Still, would have liked an official take on this. I was about to re-signup but now I'll hold off on that.
Admittedly, no full XSS anymore, but still dangerous and shows their lack of understanding and caring about security.
It's not the only place you can inject HTML and not every page has a CSP...
E.g., XSS / HTML injection in summarizer or discuss document. Or their broken CSP which allows injecting forms to e.g., change settings.
They haven't fixed many reported issues in a while, and just to prove I'm not lying: https://kagi.com/discussdoc?url=https%3A%2F%2Fkagi.com%2Fcha...
Garry Tan should know better. As an earlier article mentioned [1], he was previously quoted as saying "this kind of stuff should have zero place in San Francisco politics," referring to an activist's taunt that millionaires and landlords should be guillotined.
[1] https://missionlocal.org/2024/01/garry-tan-death-wish-sf-sup...
They didn't answer multiple mails in 30 days, so it's being disclosed.