A password-reset page has the token in its URL: https://app.example/reset?token=abc123. The page loads an analytics script from another site. With no Referrer-Policy set, what Referer does the analytics request send?

Modern browsers default to strict-origin-when-cross-origin. Requests to other origins get only the origin, and requests to your own origin get the full URL. But there is a catch: the analytics script runs in your page, so it can read location.href and the token anyway.

"The full URL, including the token" is the tempting wrong answer. That was the old default. Fixes: remove the token from the URL right after reading it with history.replaceState, set Referrer-Policy: no-referrer on sensitive pages, keep third-party scripts off them, and make reset tokens short-lived and single-use.