Similar to this helpful topic about HSTS…
… should the Content Security Policy HTTP response header also not be defined on all TLS websites in Monzo’s portfolio? It can help reduce cross-site scripting risk, and missing security controls like this would be reported as a vulnerability in application security testing.
It is probably better to have this type of discussion in the Monzo Developer’s Slack channel.
It’s easier to have a quick back and forth conversation with the members of the team who deal with this sort of thing there & the average non-techie user will definately have no idea what you are on about in this community
@alexs Probably worth considering this as being a duplicate and merging it into CSP/HSTS/HPKP (security headers) on Monzo.me
A post was merged into an existing topic: CSP/HSTS/HPKP (security headers) on Monzo.me