Wow, I hit a XSS on a Cloudflare protected site, and a cloudflare XSS bypass has cloudflare scanning my browser instead of giving me a “Blocked” message… interesting.