Never inject persistent XSS payloads in a production healthcare system - Use only non-destructive probes (console.log, unique string reflection) - Report immediately---healthcare XSS is a patient safety issue