Opening the dev console in Safari and Chrome, there's an injected https://static.cloudflareinsights.com/beacon.min.js tag at the very end of the body. If I curl the site, it's not injected, but if I copy as cURL from Chrome's dev tools and run that curl command, the script is injected again.
alt Hacker News
Opening the dev console in Safari and Chrome, there's an injected https://static.cloudflareinsights.com/beacon.min.js tag at the very end of the body. If I curl the site, it's not injected, but if I copy as cURL from Chrome's dev tools and run that curl command, the script is injected again.