I reported an XSS to Phlex yesterday and since it was pretty quickly fixed, I wrote a post about it: https://greg.molnar.io/blog/the-tale-of-an-xss-in-phlex/