There are so many possible bypass available, I changed the regex to be only ${.*//(.*)} because that’s the only real way to be sure! Except I’m still unsure about the // thing… but hey… We’re not a WAF! We’re just here for the shiny ones! https://t.co/U6XExzhosl