# SEC-006: formaction or base sending forms elsewhere

**Error**: the page doesn't build until this is fixed.

A button's `formaction` and a `base` tag change where a form is sent. Pointed at another site, they send the
form there with everything in it, including hidden fields like the CSRF token.

## Fails

```hypra fails
page(title: "Shoes", description: "All our running shoes, from light racers to trail shoes.") {
  h1 "Shoes"
  form("/newsletter", name: "newsletter") {
    field("email", type: Email, label: "Email")
    button "Subscribe"
    button(formaction: "https://mail.example.com/subscribe") "Subscribe with Example Mail"
  }
}
```

## Fixed

```hypra passes
page(title: "Shoes", description: "All our running shoes, from light racers to trail shoes.") {
  h1 "Shoes"
  form("/newsletter", name: "newsletter") {
    field("email", type: Email, label: "Email")
    button "Subscribe"
  }
  form("https://mail.example.com/subscribe", name: "external") {
    field("email", type: Email, label: "Email")
    button "Subscribe with Example Mail"
  }
}
```

Another site gets its own form, which sends only what's in it.