Users can wreak havoc on a site by accidentally (or intentionally) creating a URL aliases which correspond to administrative or otherwise important URLs. (For example 'admin', 'sites', etc).
This is a proof-of-concept module demonstrating how it is possible to create Javascript for embedding any block from a Drupal site onto a third-party site.
SecKit provides Drupal with various security-hardening options. This lets your mitigate the risks of exploitation of different web application vulnerabilities.
SecKit facilitates certain mitigations for Cross-site Scripting, Cross-site Request Forgery, and Clickjacking, among other issues.