Google tries to cross out XSS attacks by releasing its own test tool

Just about every content security policy does it wrong

Google has spent more than US$1.2 million (920,400, A$1.6 million) in the last two years paying researchers for reporting cross-site scripting (XSS) attacks and has kicked off an effort to help crush the threat."