When prod site greets users with an unsanitized JavaScript alert instead of content

Level 1: The Fancy Sign at the Front Door

Imagine a company throws a big party to show everyone how organized and modern they are. They put a beautiful locked glass case by the front door for the welcome poster — and someone sneaks in overnight and puts a note with a rude insult inside the case. Now the lock is doing a perfect job... of protecting the insult. Every guest walks up, sees the official company sign saying something awful, and the lock sparkles proudly. That's the joke: the thing meant to prove "we've got everything under control" is the thing broadcasting, in the company's own voice, that they very much don't.

Level 2: What You're Actually Looking At

• alert(): a built-in JavaScript function that pops a blocking native dialog. It's used for quick debugging and, infamously, as the "hello world" of hacking demos — if an attacker can make your site run their alert(), they can run anything.
• XSS (Cross-Site Scripting): a vulnerability where attacker-supplied text gets executed as code on a victim site — say, a comment field whose contents are inserted into the page without sanitization. The polite proof is alert(1); the impolite proof is what you see here.
• Defacement: an attacker replacing a site's content with their own message. Low sophistication, high embarrassment.
• Subdomain: agileday.mts.ru lives under the main mts.ru domain but is typically a separate, often less-guarded server — event sites and landing pages are notorious weak points.
• HTTPS padlock: proves the connection is encrypted and the server is who it claims to be. It does not prove the content is trustworthy — a lesson this image teaches better than any security training slide.

The junior-engineer takeaway: every page you ship under the company domain carries the company's name in the dialog title. The browser will literally put "yourcompany.ru says" above whatever your code — or your attacker's code — decides to say.

Level 3: Sprint Zero, Security Zero

The screenshot is brutally minimal: a blank white page served from agileday.mts.ru — an Agile-branded event subdomain of MTS, one of Russia's largest telecoms — displaying nothing but a native browser dialog:

agileday.mts.ru says Ты пидор

The message is a crude Russian homophobic slur ("you're a f-----"), delivered through the most primitive UI primitive JavaScript has: alert(). One blue OK button. And, in the corner of the frame, the HTTPS padlock glowing reassuringly — the insult is, at least, encrypted in transit.

For developers, the comedy is layered archaeology. First, the mechanism: a native alert() on an otherwise empty production page is the universal signature of two scenarios, both embarrassing. Either it's a defacement — someone gained write access to the page or its scripts and left the digital equivalent of spray paint — or it's a stored/reflected XSS proof-of-concept, because alert(1) (or, regionally, alert('Ты пидор')) is the canonical payload security researchers use to demonstrate script injection. The browser even rats out the origin with its anti-spoofing header: "agileday.mts.ru says." Yes. It certainly does. That attribution line exists precisely so users know which site is talking to them; here it functions as a signed confession.

Second, the target: an Agile Day page. The whole premise of corporate Agile evangelism is "we are modern, we iterate, we have CI/CD and code review and definitely not FTP credentials from 2011 taped to a wiki." A telecom-scale enterprise spinning up a one-off marketing microsite is the classic soft underbelly — event pages are built by contractors on deadlines, parked on subdomains outside the main security perimeter, and forgotten the day after the event. Subdomain sprawl is how serious orgs end up serving slurs over TLS: the certificate auto-renews forever, the CMS doesn't. The padlock here is the perfect emblem of security theater — transport encryption faithfully protecting the integrity of an attacker's message all the way to your screen.

Third, the corporate irony loop: a page meant to demonstrate engineering maturity instead demonstrates the gap between talking about process and operating software. The retrospectives, the sticky notes, the two-day workshop on psychological safety — none of it patches a CMS. Someone got a ticket out of this, and its priority was set faster than any backlog grooming session in company history.