// archive
// TL;DR I found a content injection (content spoofing) issue on Instagram’s password-reset confirmation page. A query parameter on the page was reflected directly into the…