I'm gonna invoke hanlon's razor (never attribute to malice what can equally be explained by stupidity) here to assert that this isn't an attack. Looks like the

I'm gonna invoke hanlon's razor (never attribute to malice what can equally be explained by stupidity) here to assert that this isn't an attack. Looks like their main homepage doesn't have a CSP policy at all https://cspvalidator.org/#url=https://www.barclays.com https://cspvalidator.org/#url=https://www.barclays.com I really hope they have a postmortem and actually implement a CSP for their site, pretty crazy not to, especially for a bank.