The browser is not a witness
We found the same hole twice, in two systems written a year and a half apart by people solving unrelated problems. Neither was a subtle cryptographic mistake. Both were the same sentence, written twice: The browser told us which organisation this request is for, and we believed it.