the policy that arrives in stages, and the runtime it broke
A browser security policy is easy to write and expensive to switch on. Every directive that closes a hole is also a promise that the application already behaves well, and this application was written before anyone made that promise.