yes storing your token in localStorage is vulnerable to XSS
but I can also wreak havoc by making requests on your behalf if you store your token in an httpOnly cookie
XSS wrecks you either way
@acdlite Not only lines, I'd add unchanged files as well (there should be a way to include a specific file into review to not make the PR so big with unchanged files).
On GitHub, I wish you could review parts of the code that haven't changed.
Maybe this was an intentional product choice, the idea being that unchanged lines aren't relevant to the PR.
But sometimes they are relevant precisely because they *should* have changed.