Public GoCD bug reports.

Team Bounty Title
GoCD - Reflected XSS vector
GoCD - X-Content-Type-Options header missing at Auth Login
GoCD - Directory Listening