JSONP wraps a JSON response in a JavaScript function call, loaded via a script tag to bypass same-origin restrictions. Insecure by modern standards, largely obsolete since CORS became universal. If you see JSONP in code review in 2026, it's a red flag.