Yes I think that was the intention. You reduce the attack surface for injection attacks because the injected code must route all requests through example.com. E

Yes I think that was the intention. You reduce the attack surface for injection attacks because the injected code must route all requests through example.com. Example.com will implicitly trust api.creditmerchant.net as it does today, but that dependency once loaded won’t be able to make requests to untrusted resources categorically because it must route thru example.com. It seems like a spoiler for chaining attacks.