Comment by kro

It's seriously infuriating receiving these "Critical vulnerability reports" customers let other agencies do, and having to justify why you have no Referer-Policy header.

Nice to read that you are reasonable.

Also, they want a strict CSP while serving 10 different ad networks :)