BUG BOUNTY PoC — This page loaded INSIDE Superhuman's mail iframe
window.location.href:
window.origin:
document.domain:
window.parent === window:
navigator.userAgent:
typeof NativeApi:
window.frameElement:
timestamp:

This page is served from iterable-links.superhuman.com.lazyloader.in and has been loaded inside the Superhuman mail rendering iframe due to a hostname validation bypass in _isDeeplink(). The original CSP no longer applies and JavaScript is executing.