Frame-ancestors / XFO gaps
The sensitive page is the one that matters. Marketing sites are almost always framable and almost never in scope as a finding.
Tags: clickjacking, csp, xs-leak
Techniques
Header only on /
CSP/XFO set on the shell, missing on /account/disable-2fa or the OAuth consent page.
Compare CSP on / vs the action URL
frame-ancestors 'self' plus a sibling
A takeover or XSS on a sibling that is 'self' for the parent cookie domain.
frame-ancestors https://target.com https://*.target.com
XFO SAMEORIGIN vs CSP
Browsers honour CSP frame-ancestors over XFO. A weak CSP wins against a strong XFO.
X-Frame-Options: DENY plus frame-ancestors *