{"service":"admin previewer","hint":"GET /admin/visit?url=<attacker html>","filter":"script tags are rejected, but images still load with the admin session"}