What was "stolen"
Paste exactly what an attacker would see in "View Source" on the tenant's real marketing site - the live embed snippet, key included.
Run the attempts
| Result | Attempt | Detail |
|---|
Visual attempts (look, don't just read)
A blocked frame stays blank / shows a browser error page. Open DevTools Console - you
should see a "Refused to display ... in a frame" or CSP frame-ancestors violation for
each iframe below.
A1. Stolen JS snippet, pasted verbatim
Exactly what the loader script + custom elements do on the real site. Expected: the loader itself loads fine (it is a public static file), but each widget's own data call gets rejected, so they should show only an "unavailable" placeholder - never real content.
A2. Stolen iframe snippet, pasted verbatim
Expected: the browser refuses to render the frame at all (CSP frame-ancestors
only names the tenant's real allowlisted origins) - a blank box, not the widget.
A6. Clickjacking probe on a normal app page
Framing ANY page of the real app (not just /embed/*) should be refused unconditionally -
X-Frame-Options: DENY / CSP frame-ancestors 'none', no key involved at all.
This proves the rest of the SaaS cannot be framed regardless of the embed feature.