If you know the answer please tell me here about it. I've send some XSS vulns to domain hosters in order to help them. They were friendly, but imagine a case where they decide to go awry instead and accuse me of "hacking" them.