3 ms·
If it’s straight up linking a non-versioned file (e.g. live file) it implies the owner of that Github repo has direct access to update and run code in client’s
by khalilravanna 6y ago
If it’s straight up linking a non-versioned file (e.g. live file) it implies the owner of that Github repo has direct access to update and run code in client’s browsers. Could start shooting off API requests dumping the contents of cookies/localStorage, set up keylogging, etc. IMO seems like a pretty big security hole.