3 ms·

PSA: make sure your Website has a strict Content Security Policy[1]. 1. https://medium.com/hackernoon/im-harvesting-credit-card-numbers-and-passwords-from-your

• crtasm 6y ago
  > ...the following four lines of code will glide right through even the strictest content security policy. > (In an earlier iteration of this post I said that a solid content security policy would keep you (and I quote) “100% safe”. Unfortunately 130k people read that before I learned the above trick. So I guess the lesson there is that you can’t trust any thing or any one on the internet.) Though the approach only applied to Chrome, and the post is two years old so I don't know if it still works today?