i was looking at an app this morning with xssdoctor and we figured out something really neat. if you have a CSRF you can't exploit due to sec-fetch-site, you can use desktop apps (like electron apps or iMessage, etc) b/c they set sec-fetch-site to none which can be a bypass

Fight Chat Control. You cannot make society secure by making people insecure. We all deserve privacy and security, without inevitably hackable backdoors, for our private communications. The fact that the government officials want to exempt themselves from their own law is

new exploit on every slide at Johann Rehberger 's keynote #aiagentsecuritysummit