Acknowledged by BufferApp

I was able to bypass their XSS filter and also found a issue with session cookies. For my responsible disclosure I got acknowledged.