The goal was to exfiltrate the note from the bot using an XS-Leaks technique called “Cross-Origin Redirects and CSP Violations”.

Full explanation can be found [here](https://www.xanhacks.xyz/p/secrets-hacktmctf/).