everyone who saw the tweet retweeted it automatically. it also displayed an alert saying "xss in tweetdeck". because tweetdeck didn't have any precautionary measures, it only worked for tweetdeck users and the code was only showed and executed for them. the only thing twitter users saw was the heart. it got 83 thousand retweets before it was fixed.