buildOne report1 publisher GoodBarber now serves on-device web content in its iOS apps from https://secure.internal, through a WKWebsiteDataStore proxy API added in iOS 17. A fixed name gives the company's token issuer one origin to allowlist, where the old loopback server needed a wildcard that matched any port on the phone.
Reality
- Evidence55
- Adoption20
- Hype gap0
- Incentives30
- Confidence55
Microsoft will allow only scripts from its own CDN domains during Entra ID browser sign-ins under a Content Security Policy enforced from mid-October 2026. Browser extensions and tools that inject code into the sign-in page will stop working as the rollout completes in late October.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+10
- Incentives30
- Confidence70
buildOne report1 publisher WorldScript Studio says its passphrase encryption covers PWA data in IndexedDB but not its Tauri desktop app's filesystem project store. The same React/Vite code runs in both, so the storage path decides what a user's encryption setting actually protects.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap−15
- Incentives
- Insufficient
- Confidence50
buildOne report1 publisher MDN now lists the Trusted Types API as Baseline 2026, newly available. The JavaScript half only lets you sanitize; require-trusted-types-for is the part that makes an unsanitized assignment throw, and the sanitizer stays yours to write.
Publishers:developer.mozilla.org
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap+8
- Incentives22
- Confidence63
buildOne report1 publisher The PDF tools run pdf.js, pdf-lib, qpdf and Tesseract as lazily loaded WASM inside the tab, and one CSP directive turns the privacy claim into something you can check in the Network panel instead of read in a policy.
Reality
- Evidence42
- Adoption
- Insufficient
- Hype gap+18
- Incentives78
- Confidence44
buildOne report1 publisher A per-request nonce met a statically prerendered page, and the browser refused every script it was sent. Six health signals, including a 3,500-test suite, reported fine.
Reality
- Evidence60
- Adoption20
- Hype gap+8
- Incentives30
- Confidence55
buildOne report1 publisher Mixed content is the failure most likely to break a secure page, and it answers 200, so status-code checkers pass it. A Merlonix post argues the fix is protocol inspection, not more fetching.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+25
- Incentives85
- Confidence52
buildOne report1 publisher A bank-statement converter enforcing connect-src 'none' skipped SheetJS and implemented the four files it needed. Then a green 26-test suite missed a CSP failure only the real page could show.
Reality
- Evidence46
- Adoption14
- Hype gap−8
- Incentives62
- Confidence54