Tines now supports the Cross-Origin-Opener-Policy (COOP) header. COOP is a modern, defense in depth measure with wide support from web browsers that allows us to restrict cross-site interactions with Tines content, mitigating entire classes of vulnerabilities.

This has been fully rolled out to our cloud environment. Self hosted customers, as of version v40.1.0, can enable it by setting COOP_ENABLED=true.