XSS
Just last week, Dependabot alerted us to CVE-2026-73295, a DOM-based XSS in Material for MkDocs, the theme behind docs.report-uri.com. Dependabot opened the bump for us overnight, so it was a simple enough fix, but I was curious what the impact was. It turns out
Newsletter
August was the month a couple of long-running betas finished, and the month we started publishing the research that sits behind the product. Here's everything we shipped. Connection Allowlist is out of beta 🔌 Chrome 152 went stable on 25th August with Connection Allowlists shipped to desktop, Android
JavaScript Integrity Monitoring
Right now, on our own production site, I can tell you the cryptographic fingerprint of every single JavaScript file that executed in a real visitor's browser this month. Not what our build system produced. Not what our CDN thinks it's serving. What actually ran, in the
Magecart
Most of the client-side attacks we track generally do one thing. A skimmer skims, or a ClickFix lure talks someone into pasting a command. They come from different operators, they use different infrastructure, and we list them separately in our Threat Intelligence feeds. This one does both, from the
Connection Allowlist
Until now, malicious code running in a browser has had several ways to send data somewhere it shouldn’t, including new channels that CSP cannot fully cover and channels that do not even appear in the Network tab in Developer Tools. Chrome 152 changes that. Connection Allowlist is effectively an
CSP
No injected <script> tag. Nothing loaded from an attacker-controlled origin. A PHP shell at the end of it. A CSP kills this chain on the login page, and can tell you when someone tries. That's exactly what we're for. WordPress shipped an emergency
PCI DSS
The run-up to the PCI DSS 4.0 deadline was, to put it kindly, confusing — requirements added, softened, pulled from questionnaires, then reintroduced as guidance weeks before merchants had to comply. Strip away the noise and one question is left for every e-commerce merchant: do you actually know
MCP
Every SaaS product I use has grown a little chat bubble in the bottom right corner. Ours hasn't, and it isn't because we forgot. When we sat down to work out what AI should look like in Report URI, the obvious thing to build was an
PCI DSS
For over a decade, PCI DSS treated the browser as someone else's problem. Card data was protected in transit and at rest on the server, but the code actually running in the customer's browser — where card details are typed in — sat largely outside the standard'
Newsletter
July has been about taking the features we've been building in beta wider, sharpening your tooling and giving you back more of your quota. Here's everything we shipped. Our betas are graduating to open beta 🎓 The access-control and enterprise features we launched in beta over
ClickFix
A customer forwarded us something last week that has stuck with me. It was a live attack campaign — a good one, in the professional-admiration sense — along with a detailed public write-up dissecting exactly how it worked. The analysis was genuinely impressive. It traced the whole thing from the
PCI DSS
Stripe's PCI assessment now has a mandatory checkbox: confirm you've deployed a Content Security Policy. Here's what you're attesting to, and how to do it.