← All topics

Posts tagged incidents

1. September 10, 2026·7 min read·Updated September 22, 2026

   What CSP and script hash reports would have shown during the polyfill.io attack

   In 2024 a CDN embedded on 100,000+ sites changed owners and began serving malicious code to mobile visitors. What a violation report would have shown, what a hash report would not, and why.

   • incidents
   • supply-chain
   • script-hashes
   • csp-reports
   • client-side-security

2. September 1, 2026·6 min read

   How Magecart skimmers show up in CSP violation reports

   Card skimmers arrive as a new script, a modified one, an inline handler or a fake payment form, and send data to lookalike hosts. Which CSP report each variant produces, and which produce none.

   • magecart
   • csp-reports
   • incidents

3. August 11, 2026·5 min read

   What a CSP report would have shown during the Ticketmaster breach

   A vendor-hosted chat widget sat on Ticketmaster's payment page. Modified at the vendor, it skimmed cards for four months. The report a policy on that page would have sent, and what it could not see.

   • incidents
   • magecart
   • supply-chain
   • csp-reports
   • client-side-security

4. July 29, 2026·5 min read

   What a CSP report would have shown during the British Airways breach

   For 15 days in 2018, 22 lines added to a script on ba.com copied card details to baways.com. The connect-src report that names a host like that on its first request, and what CSP leaves unsolved.

   • incidents
   • magecart
   • csp-reports
   • client-side-security