The filename are already covered in `XSS Injection/README.md`
The note is not visible to the blocked user.