Matt Menke

No size limit

10

The algorithm doesn't seem give a size limit on how much body is loaded into memory to try and parse as JSON. Caching arbitrary amounts of data in memory to...

event_attribution_reporting_clicks.md is very hard to follow.

6

I'm trying to read this doc, and find it very hard to understand. It talks a lot about "triggering attributions" without first defining "triggering" There is a "triggering attribution" section...which...

Network Partition Key for reports is not specified

4

Conversion measurement reports have information collected in two different first party network contexts (publisher page, report destination (?), and are potentially reported to yet a third site. To avoid leaking...

RFC1918 requires protections against requests initiated by remote sites being made to local devices, to protect local devices whose security models rely on them not being web-accessible from being web-accessible...

Some potential other things to test at the network layer

5

Disclaimer: I'm not sure how practical most of these are to test, and a lot of these are a bit on the obscure side. I've mentioned most of these on...

Better describe different "feature types"

3

**Is your feature request related to a problem? Please describe.** The current descriptions when adding a feature are insufficient - I have no idea what any of the trpes actually...

Algorithm for determining what is and is not a MIME type seems to be undefined.

4

### What is the issue with the MIME Sniffing Standard? The section "Interpreting the resource metadata" / "To determine the supplied MIME type of a resource" has the step: "If...