W Identity (widentity.eu) asks people to hand over passport scans, a biometric selfie and their date of birth to prove who they are. The reflected XSS vulnerability let attacker-controlled JavaScript run on your site's own origin. For an identity provider, your response is way too relaxed.