You can use CSP to prevent content exfiltration as well, not just script execution. There&#x27;s a number of directives suited for that: img-src, form-action, child-src, etc. Full list on MDN: <a href="https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Web&#x2F;Security&#x2F;CSP&#x2F;CSP_policy_directives" rel="nofollow">https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Web&#x2F;Security&#x2F;CSP&#x2F;CS...</a>