Common XSS Mistakes in Paperform and How to Fix Them
Paperform makes it easy to ship forms fast. That convenience is also where teams get sloppy. I’ve seen the same pattern over and over: a safe hosted form gets wrapped in unsafe frontend code, piped through insecure automations, or embedded into pages that trust user input way too much. Paperform itself isn’t the whole story. XSS usually shows up in the code around it: confirmation pages, embed wrappers, analytics hooks, custom HTML blocks, webhook consumers, and admin dashboards displaying submissions. ...