An attacker uses browser DevTools to disable the 'required' attribute on a form's email field and submits the form without an email. What does this demonstrate?

• A.HTTPS (TLS) encrypts form fields in transit: the server sees only the encrypted field values, a protection that makes extra server checks unnecessary for fields whose rules were declared in the markup
• B.Cross-site request forgery (CSRF) tokens validate the email field: the form is rejected when the token is missing, a check that all frameworks run before the markup is read by the server handler
• C.Content Security Policy (CSP) blocks DevTools edits: the browser lets only the site owner change the markup, a rule that holds for each form on a protected site
• D.HTML attributes (required, maxlength, pattern) are only client-side convenience checks that can be trivially removed in the browser; server-side validation is the only authoritative control