Insecure PostMessage Configuration
Overview
Detects careless use of the HTML5 Web Messaging API (postMessage), such as sending messages to the generic '*' origin.
Remediation
Always specify the exact target origin in window.postMessage(). When receiving messages, rigorously verify event.origin.