The `returnUrl` query parameter can be used to execute malicious code. For
example, visiting
`http://localhost:9876/?return_url=javascript:alert(document.domain)` will
display an alert.

Setting `singleRun` and `autoWatch` to `false` will not immediately run
anything. Warn the user about this.

It is incompatible with IE.

## [6.3.14](v6.3.13...v6.3.14) (2022-02-05)

### Bug Fixes

* remove string template from client code ([91d5acd](91d5acd))
* warn when `singleRun` and `autoWatch` are `false` ([69cfc76](69cfc76))
* **security:** remove XSS vulnerability in `returnUrl` query param ([839578c](839578c))