Just closed a Lobsters security bug that allowed commenters to use any hat. Thanks to David Wolgemuth for reporting and patching this. An audit showed it was never exploited. https://github.com/lobsters/lobsters/commit/07a0a4fd88e5a4836cc5cb6616663232b7b2aa86