Hi @jcarroll ! For me, it is:
- User session management (authentication, number of sessions, session lenght). I have even posted about it, but it did not gain much traction
I guess it is a problem mainly in corporate production enviroment.
- CSS injections (as mentioned above by @DarkCSS )
- JS injections - currently some hacky ways needed window.parent and so on.