Dave Smith just emailed to let me know that the theme I’m using is vulnerable to a cross-site scripting attack. He’s detailed the fix here, which I’ve applied. If you’re using depo-skinny, you’ll want to fix it as well.