Or it was that kind of bug report where the reporter made a normal thing sound dangerous. I remember one case when someone suggested that JS should be turned of

Or it was that kind of bug report where the reporter made a normal thing sound dangerous. I remember one case when someone suggested that JS should be turned off by default because "arbitrary code execution" :) Edit: with chrome extensions, I can inject a script tag from any domain to any page. I used that to inject a lib from CDN JS, but recognized it's silly and imported the package instead.