Drupal version 8.0.0 Beta 14 suffers from a cross site scripting vulnerability. Drupal’s sad fix was to simply throw an .htaccess file in place to block access to the file.