Deny everything, embed anyway
The page sets a policy denying every resource type by default, and the team treated that as covering embedding too. An attacker's site puts the page in an invisible frame over their own buttons, so a click lands on a control the user can't see.
The default-deny is real. It just doesn't reach this.
Add the directive that actually controls who may embed the page.
Components — tap one, then tap a slot on the diagram
!The page is embedded in an attacker's invisible frame despite a deny-by-default policy.
Outside every boundary: Deny everything (the catch-all directive), Your page, Attacker's page (frames yours invisibly; FAILED: embedding you), an empty slot for the who may embed this Connections: Attacker's page calls who may embed this — tries to embed (step 1) who may embed this calls Your page — only permitted embedders (step 2) Deny everything controls Your page — covers resources, not framing
Deny everythingthe catch-all directive
Your page
Attacker's pageframes yours invisiblyembedding you