3 ms·
If you serve any third party logic, such as advertisements, your code is just as potentially compromised.
by austin-cheney 5mo ago
If you serve any third party logic, such as advertisements, your code is just as potentially compromised.
- troad 5mo agoOnly the frontend, which is already untrusted. Any risk would be restricted to individual users who used the compromised frontend to communicate something sensitive, and while that's not great, it is significantly better than the backend being compromised. A very significant reduction in blast radius. Funnily enough, I don't actually think I do serve third party JS, though. Don't serve ads, don't use external telemetry, don't use JS CDNs. I don't think you have to go quite as far as I do, though - I imagine if your ads are Google AdSense or something, you're probably going to be fine.