Content security policy seems to block this for me, so at least there is that. Content-Security-Policy: default-src 'self'; script-src 'self' platform.twit

Content security policy seems to block this for me, so at least there is that. Content-Security-Policy: default-src 'self'; script-src 'self' platform.twitter.com syndication.twitter.com gitcdn.github.io code.jquery.com maxcdn.bootstrapcdn.com cdnjs.cloudflare.com dcggld9bcojs3.cloudfront.net; img-src data: 'self' dcggld9bcojs3.cloudfront.net; style-src 'self' 'unsafe-inline' gitcdn.github.io maxcdn.bootstrapcdn.com cdnjs.cloudflare.com; font-src 'self' data: ; form-action 'self'; child-src 'self' platform.twitter.com; connect-src 'self' syndication.twitter.com; I'm not entirely sure why gitcdn.github.io is on list of allowed script paths, but at least XSS injection is not straightforward, to run scripts, you need to hijack one of those hosts. --- As for insecure claim, it does have an XSS attack, but Content-Security-Policy reduces its impact to minimum. You cannot make do a request to an arbitrary domain by loading an external resource. So even if one part is insecure, the other one prevents an attack - security in depth. Of course, they still should fix that XSS attack. I also decided to check if they don't sign certificates for domains that disallow this (by means of CAA DNS record). They properly do, as SSL baseline requirements say, so nothing to report.