# NNS FE Dapp XSS vulnerability Incident Retrospective - Friday August 19, 2022

**URL:** <https://forum.dfinity.org/t/nns-fe-dapp-xss-vulnerability-incident-retrospective-friday-august-19-2022/14973>\
**Category:** Developers\
**Created:** [August 19, 2022, 2:13pm UTC](https://forum.dfinity.org/t/nns-fe-dapp-xss-vulnerability-incident-retrospective-friday-august-19-2022/14973 "2022-08-19T14:13:49Z")\
**Posts on this page:** 1\
**Showing post:** 17

<div class="post-metadata">

**Author:** ![peterparker](https://avatars.discourse-cdn.com/v4/letter/p/b9bd4f/32.png) [@peterparker](https://forum.dfinity.org/u/peterparker)\
**Post date:** [September 6, 2022, 3:52pm UTC](https://forum.dfinity.org/t/nns-fe-dapp-xss-vulnerability-incident-retrospective-friday-august-19-2022/14973/17 "2022-09-06T15:52:38Z")

</div>

> [@janosroden](#):
>
> completely unverifiable

Not unverifiable. As mentioned in my post:

- Checking the hash of the deployed wasm is possible as described in the [upgrade proposal](https://dashboard.internetcomputer.org/proposal/76202)

- The commit is also tagged as “[Proposal-76202](https://github.com/dfinity/nns-dapp/releases/tag/proposal-76202)”

> [@janosroden](#):
>
> I’m just curious what are the plans / options to balance between security and decentralization.

As mentioned in the proposal, the process followed the Security Patch Policy and Procedure that was adopted in proposal [48792](https://dashboard.internetcomputer.org/proposal/48792) (which also reference forum post [11069](https://forum.dfinity.org/t/feedback-wanted-security-patch-policy-and-procedure/11069)) - i.e. this proposal defines the plans / options to handle such critical incident.

Hope that answer your question and concern?

---

_[View the full topic](https://forum.dfinity.org/t/nns-fe-dapp-xss-vulnerability-incident-retrospective-friday-august-19-2022/14973)._