← All topics

Posts tagged client-side-security

1. September 19, 2026·5 min read·Updated October 9, 2026

   Beyond CSP: the other reports browsers send, and how to sample them

   Browsers report broken security policies, deprecated APIs, failed requests and crashes through the same API as CSP. What each type tells you, and how to keep the noisy ones affordable.

   • reporting-api
   • csp-reports
   • client-side-security

2. September 19, 2026·5 min read·Updated September 24, 2026

   You'd never ship code to a server with no controls. So why the browser?

   We wrap our servers in layer after layer of controls, then ship the same code to a machine we do not run and add almost nothing. What the browser layer is, and how to start it.

   • client-side-security
   • csp-reports

3. September 10, 2026·7 min read·Updated September 22, 2026

   What CSP and script hash reports would have shown during the polyfill.io attack

   In 2024 a CDN embedded on 100,000+ sites changed owners and began serving malicious code to mobile visitors. What a violation report would have shown, what a hash report would not, and why.

   • incidents
   • supply-chain
   • script-hashes
   • csp-reports
   • client-side-security

4. August 11, 2026·5 min read

   What a CSP report would have shown during the Ticketmaster breach

   A vendor-hosted chat widget sat on Ticketmaster's payment page. Modified at the vendor, it skimmed cards for four months. The report a policy on that page would have sent, and what it could not see.

   • incidents
   • magecart
   • supply-chain
   • csp-reports
   • client-side-security

5. July 29, 2026·5 min read

   What a CSP report would have shown during the British Airways breach

   For 15 days in 2018, 22 lines added to a script on ba.com copied card details to baways.com. The connect-src report that names a host like that on its first request, and what CSP leaves unsolved.

   • incidents
   • magecart
   • csp-reports
   • client-side-security