Accounts are protected by two-step sign-in, and every important action in the panel goes into a log. Forms are protected against forged requests, and uploaded files are checked by content, not by name.
Each page gets its own script key: foreign inline code will not be run by the browser. Even if something extra slips into a text, it stays just text.
Пока никто не высказался. Будьте первым.