Arc knew that sharing custom JavaScript could be risky, so they never officially allowed users to share Boosts that included custom JavaScript. However, this exploit found a loophole in that system.