Instructor note: this section is a realistic target. Nine everyday features (search, comments, the tip line, author bios, the newsletter, share links, tag pages, the draft preview, language) each hide an XSS. Hunt them like a real app - no numbered levels.