Browser Security and Data Stewardship

Set embedding and capability limits, guard DOM sinks, pin dependencies, and keep telemetry lean.

A web service can validate requests and still leak through an embedded page, an unsafe DOM sink, a changed remote script, or a log that keeps too much case data. Browser response controls, output handling, dependency review, and telemetry policy address different failure paths. None replaces authorization. The lessons make these boundaries concrete with a case-review application, staged rollout checks, and explicit notes about what a small snippet cannot enforce alone.

Topics in this track

Embedding and Browser Capability Headers — Constrain framing, referrer disclosure, and browser features with response policy that matches the route.
DOM Sinks and Trusted Content — Render untrusted strings as text and tightly control the rare path that needs authored HTML.
Dependency Integrity and Update Window — Keep browser dependencies reproducible and review the code that changes between releases.
Telemetry Minimization and Retention — Record operational signals without turning logs into a second store of private case content.