Every page is served with a Content-Security-Policy, and until now its script rule allowed any inline script at all - which meant it protected nothing. Each response now carries a one-time token that the site's own scripts are marked with, and the browser refuses to run any script that does not have it. Anything injected into a page cannot have that token, because it is generated fresh for every request. Nothing about the site should look or behave differently.
Tightened the browser security policy around scripts
Pages now tell the browser exactly which scripts are allowed to run, so injected script is blocked even if it ever gets onto a page.