second part of your post looks vague. I'd say any GET-accessible .js template is leaking all data it has inside. It's not precisely JSONP. It turns out to be J

second part of your post looks vague. I'd say any GET-accessible .js template is leaking all data it has inside. It's not precisely JSONP. It turns out to be JSONP, unintendedly. This is where it becomes vulnerable