For what it's worth, Keystone had a similar bug that we simply said "wont fix" as sanitizing the response (don't render JSON as html) is largely the client's responsibility.
I believe this bug should be switched to public at this point.
For what it's worth, Keystone had a similar bug that we simply said "wont fix" as sanitizing the response (don't render JSON as html) is largely the client's responsibility.
I believe this bug should be switched to public at this point.