Phishing and BEC: The Attack That Skips Your Code

You can write perfect code. Parameterized queries, escaped output, a locked-down CSP, the whole kit....