Posts tagged supply-chain

September 10, 20267 min readUpdated September 22, 2026
What CSP and script hash reports would have shown during the polyfill.io attack
In 2024 a CDN embedded on 100,000+ sites changed owners and began serving malicious code to mobile visitors. What a violation report would have shown, what a hash report would not, and why.
August 11, 20265 min read
What a CSP report would have shown during the Ticketmaster breach
A vendor-hosted chat widget sat on Ticketmaster's payment page. Modified at the vendor, it skimmed cards for four months. The report a policy on that page would have sent, and what it could not see.

What CSP and script hash reports would have shown during the polyfill.io attack