1-Click GitHub Token Stealing via a VSCode Bug

neat writeup/exploration of web bypasses. "send any key u want to the iframe" is a p powerful primitive, rest is (necessary!) window dressing