6 min read
Card skimmers arrive as a new script, a modified one, an inline handler or a fake payment form, and send data to lookalike hosts. Which CSP report each variant produces, and which produce none.
5 min read
A vendor-hosted chat widget sat on Ticketmaster's payment page. Modified at the vendor, it skimmed cards for four months. The report a policy on that page would have sent, and what it could not see.
5 min read
For 15 days in 2018, 22 lines added to a script on ba.com copied card details to baways.com. The connect-src report that names a host like that on its first request, and what CSP leaves unsolved.