2016-06-13 UTC
# 
Zegnat JavaScript cannot request the contents of a page unless specifically allowed through CORS. That’s why myhacksite.com cannot request yourbank.com pages and see their contents. So if you want the contents on yourwebsite.com accessible by JavaScript that runs on mywebsite.com, you have to whitelist mywebsite.com. Or just whitelist everything.