Third-party script injection

Understand the boundary around the browser signing context. CISP is intended to evaluate request proof and session authority at the protected operation.

What to evaluate

Define the attack preconditions, selected profile, protected action and expected failure behaviour. Test valid requests, invalid proof, reused context and privilege transitions.

Evidence to inspect

Request decision, build and profile, reproducible method, artifact reference and explicit limitations. No independently reproduced CISP result is claimed on this page.

Complementary controls

Retain endpoint security, strong authentication, application authorisation, script governance and infrastructure controls appropriate to your threat model.

Cross-references · where applicable

Relevant to, not a compliance claim.