Content Security Policy Evolution and Defense-in-Depth

This feature thread tracks the evolution of GitHub's security posture beyond Content Security Policy (CSP). Initially, the focus was on establishing a robust CSP to prevent JavaScript execution and mitigate common web vulnerabilities. This post details the ongoing efforts to identify and address CSP bypasses and to implement additional defense-in-depth measures, particularly focusing on mitigating information exfiltration through less obvious vectors like image tags and dangling markup. The thread also covers the evolution of CSP directives and their impact on mitigating specific attack scenarios, including the use of `script-src`, `object-src`, and `img-src` to prevent XSS, scriptless attacks, and data exfiltration.