Magento
Magento 2 has shipped with Content Security Policy enabled by default since version 2.3.5. On current releases, most pages use a report-only policy, while payment pages use an enforced policy by default. Magento does not, however, know where to send violation reports unless you configure an endpoint.
XSS
Just last week, Dependabot alerted us to CVE-2026-73295, a DOM-based XSS in Material for MkDocs, the theme behind docs.report-uri.com. Dependabot opened the bump for us overnight, so it was a simple enough fix, but I was curious what the impact was. It turns out
CSP
No injected <script> tag. Nothing loaded from an attacker-controlled origin. A PHP shell at the end of it. A CSP kills this chain on the login page, and can tell you when someone tries. That's exactly what we're for. WordPress shipped an emergency
PCI DSS
Stripe's PCI assessment now has a mandatory checkbox: confirm you've deployed a Content Security Policy. Here's what you're attesting to, and how to do it.
White Paper
Passkeys are one of the best improvements to online security in a long time. They are designed to replace passwords with a safer, easier way to sign in. That means no more reused passwords, much less risk from phishing emails, and far better protection against attackers trying stolen login details