I'm specifically talking about CSRF as I've found that to be quite widespread and some analytics providers have had flaws that can lead to your account being deleted or stats sent to someone else's email address, etc. I don't know if there's a similar problem with XSS, but I trust Google's security practices more than most other companies.
I see.
I always have this idea in my head, to start a service and get people to put my script on their web sites, and pull a grand scam one day by changing the script to do something malicious on those poor sites that didn't add SRI.
