Bonus · BONUS
Framing (clickjacking)
The scenario
PetPals can be shown inside another website.
A malicious site could lay invisible buttons on top of it and trick a visitor into clicking them.
Guided hint · Beginner mode
Ask: can someone else put my app inside their website, the way a video is embedded? Check Dashboard → Settings → Browser Security for the iFrame setting.