Polymarket’s Performance Monitor Became a Wallet Drainer, and the CSP Waved It Through
no phishing, no popup. a third-party monitoring script read the session, found the app’s own signer and sold positions. why the CSP allowed every call and what would have stopped it.