The Polymarket drain did not need a bug in Polymarket's code: a script it loaded from a performance-monitoring vendor changed, and it ran with each signed-in user's session. Practical controls: (1) keep a list of every external script origin per app and remove the ones you no longer use; (2) do not load analytics, RUM, chat or A/B tools on pages that authorize payments, trades, wallet actions or show API keys, or load them in a sandboxed iframe; (3) set a Content-Security-Policy script-src allowlist and connect-src limits so an injected script cannot send data to new hosts; (4) where a vendor serves a fixed file, self-host it or pin it with Subresource Integrity (integrity=); (5) alert when a third-party script's hash changes.