For developers, the key is this: > organizations should consider implementing a content security policy (CSP) into the application [and] avoid directives such

For developers, the key is this: > organizations should consider implementing a content security policy (CSP) into the application [and] avoid directives such as unsafe-inline or unsafe-eval The problem with countering cross-site scripting is that you have to be absolutely perfect in the massive number of output locations. It is a good idea to try, and to use a framework that automatically escapes things properly. But CSP works every time, without requiring perfection.