A 16-year-old security researcher found XSS vulnerabilities in Google’s Invoice Submission Portal