Yup. Especially given OPs comments: > To be clear, letting third party JS run in a trusted environment like a dashboard is an industry wide problem. If we assu

Yup. Especially given OPs comments: > To be clear, letting third party JS run in a trusted environment like a dashboard is an industry wide problem. If we assume CircleCI is the only bad actor we're kind of missing the point of the exercise.