Security: Polyfill Supplay Chain Attack

[and-who]

Summary
Currently there is an active Security Issue:
https://sansec.io/research/polyfill-supply-chain-attack

Which warns about the usage of 'cdn.polyfill.io'.

This Project has third-party-web listet as a Dependency, which uses this URL (Could be just Test URLs but better be sure)

[starsinmypockets]

+1

[connorjclark]

There's no issue here.

[nolanlf]

Thanks for noting there is not an issue. Would it be possible to get context on why it is not an issue when the treemap/app/debug.json file references polyfill.io? (Is it just an old debug log, vs config... and are there risks polyfill.io could be called during debugging?). Thank you!

[connorjclark]

That's a test file and the url is just displayed never fetched.

[nolanlf]

Thank you. Perfect!