I don't think a guarantee can be made that the client can't tamper with it - its just an HTTPS POST request to an endpoint with a JSON body that's generated fro

I don't think a guarantee can be made that the client can't tamper with it - its just an HTTPS POST request to an endpoint with a JSON body that's generated from the browser. However, if NEL is run globally, it just becomes a part of the noise floor (someone else mentioned this as well), and to do effectively with malice will require doing this 'at scale' (that fav. phrase). So far, we haven't seen changes in the outcomes from telemetry analysis. One way of removing malicious noise could be to apply the same bot-detection capabilities for NEL that you apply for the service its monitoring.