The application
Nothing here leaves the page — the site sends connect-src 'none' and form-action 'none', so it could not if it tried. Two failures are deliberate and reachable: a branch code of 000000 is rejected by the bank, and a registered name containing timeout never gets a reply. The banking step also fails its first background save, on purpose.