[EE84M3i]

One click RCE, not zero. $1,750 still seems a little low by H1 standards, but probably not by an order of magnitude.

Cool to see how they used the html injection gadget.

Seems like slack messed up with the blog post but made a sincere attempt to make amends.

I've noticed slack is pretty good about allowing disclosure of H1 bugs. It's a really hard sell in a lot of companies, so I think they should be applauded for that.