GitHub's CSP journey

This post details GitHub's journey with Content Security Policy (CSP), highlighting its evolution from an initial, simpler policy to a more robust and restrictive one. It explains the technical rationale behind specific CSP directives like `script-src`, `object-src`, and `img-src`, and how they are used to mitigate Cross-Site Scripting (XSS) and scriptless attacks. The post also shares insights from bounty submissions that helped shape the policy, such as the `object-src` bypass involving Flash and a WebKit bug, and the `img-src` dangling markup attack for CSRF token exfiltration. It emphasizes the importance of avoiding `self` in `script-src` and restricting `object-src` to the CDN.