We recently had a penetration test done, and one of the “high” items was the fact that our servicestack API will reflect back user input unmodified to the caller. E.g. I can send some script tags in to a GET request, and will get an error on back from the API with the script tags in it:

Has anyone else experienced this, or is there anything built in to servicestack to prevent it?

Thanks!