Any harm an xss attack could do, a unsuspecting user that can be convinced of copy pasting some script into their dev tools can do as well. Therefore it's very important maybe even more important to secure your backend. That said, allowing an attacker to execute their script on all of your customers devices (xss) without them even knowing it is definitely very bad publicity and can lead to loss of any data those users have access to...
another awesome talk from Philippe De Ryck... always interesting and something to learn new every time
Any harm an xss attack could do, a unsuspecting user that can be convinced of copy pasting some script into their dev tools can do as well. Therefore it's very important maybe even more important to secure your backend. That said, allowing an attacker to execute their script on all of your customers devices (xss) without them even knowing it is definitely very bad publicity and can lead to loss of any data those users have access to...