Why CSP Isn't Enough to Stop Magecart-Like Attacks

CSP allows website owners to control where third-party code can come from, but it does not provide a robust or granular way of handling what that code does once it is executing in the browser.