GitHub's post-CSP journey

This post details specific bypasses of GitHub's CSP policy related to `img-src` directives, particularly concerning Google Analytics and Gravatar. It describes how attackers could leverage these services with injected content and dangling markup to exfiltrate sensitive information. The post outlines the technical solutions implemented: migrating Google Analytics to an XHR approach and proxying Gravatar images through GitHub's own Camo image proxy to remove them from the `img-src` list. It also introduces a strategy for mitigating dangling markup attacks by adding specific HTML comments and tags before form elements to close potential injection vectors.