@alex the javascript might come from the same domain, but exfiltration of the authentication token requires you to submit it to a third party server, correct? Unless you inject a script to exfiltrate the data over ActivityPub itself.