Inventory code and loading conditions, not just supplier names
List scripts included directly by the website, added through plugins or themes, and introduced through a tag manager or another script. Record the business purpose, source, publisher, affected pages and conditions for loading. A script may appear only after a form action, a consent choice or a particular account state.
Use authorized browser inspection and configuration review to establish the actual route. A single homepage visit cannot describe every page or interaction. Keep observed requests, configuration rules and vendor claims distinct, with the test conditions recorded. If a tag manager can publish new code, its users and change process belong in the review too.
Do not label every external request as a malicious leak. Some are necessary to deliver an approved function. The task is to establish what information is transferred, why the business needs that transfer, who controls it and whether the relevant security and privacy decisions have actually been made.
Understand the execution context and accessible information
A script fetched from an external server can execute in the host page’s context. Its remote filename does not create an isolated environment. Depending on the integration and browser controls, page scripts can interact with DOM content, form fields and other information available to that context. A separately framed integration has different boundaries that must be reviewed as implemented.
OWASP’s third-party JavaScript guidance explicitly notes that a data layer is not a sandbox and that tag-manager containers can execute code. An agreement about which values to place in an event object is useful, but it is not equivalent to confining the executing code to those values.
Avoid the opposite overstatement as well. Scripts do not automatically read every browser cookie or all information on every site. For example, HttpOnly restricts JavaScript access to a cookie, although the browser can still send that cookie with applicable requests. Describe the relevant browser permissions and context rather than using a blanket claim.
Record the information route and the responsible decision
Map each important script or tag to the information it receives, destinations it contacts and person who can change it. Check URLs, event properties, DOM-derived values, form interactions and conditional behavior where relevant. Do not rely on a friendly event name to tell you what its full payload contains.
This register is an original working aid. Capture field categories and synthetic observations instead of putting live customer information into the report. Unknown processing on the recipient’s side needs a separate provider and contractual review; browser inspection cannot prove everything that happens after a request arrives.
| Item | Information or authority to inspect | Decision and acceptance evidence |
|---|---|---|
| Direct vendor script | Loading page, execution context and requested data | Purpose owner and observed synthetic request |
| Tag-manager container | Publisher access, rules and additional loaded code | Approved change record and relevant journey checks |
| Event or data layer | Exact fields, identifiers and free-text values | Minimum useful payload verified with invented inputs |
| Page and redirect URLs | Identifiers, query values and event capture | No unnecessary personal data in the reviewed route |
| Security controls | Actual CSP, integrity and frame configuration | Supported control tested without breaking required functions |
| Provider destination | Purpose, handling terms and relevant obligations | Owner review; browser evidence and remaining questions separated |
Keep CSP, integrity and privacy decisions distinct
Content Security Policy can restrict loading and other browser behavior according to its directives. A report-only policy observes violations without enforcing that policy. Allowing a script source does not establish that everything its allowed code does is appropriate for the business or its information.
Subresource Integrity lets the browser compare a fetched resource with an expected cryptographic hash. MDN explains the additional cross-origin requirements. Integrity helps check the expected resource bytes; it does not decide whether those expected bytes collect unnecessary information. Dynamic resources and update workflows require a deliberate compatibility and maintenance decision.
Review purpose, applicable privacy requirements and consent behavior separately with the responsible owner. A banner’s appearance, an integrity attribute or an all-green security tool does not demonstrate that every data transfer is permitted. Do not paste a universal CSP into production or block domains without checking forms, checkout, authentication and other required journeys.
Test the full user journey with invented information
Choose the pages and states needed for the business process, including the relevant consent choices. Use synthetic identifiers and a controlled form route; coordinate anything that could trigger an email, order or CRM entry. Inspect requests and event payloads at the meaningful transitions, then compare the result with the intended data map.
Review server-side follow-up too when a tag forwards events through another system. A shorter browser destination list does not necessarily mean fewer recipients or less information processing. Record the boundary of the observation and ask the owner for the remaining configuration evidence.
Maintain the smallest useful, accountable script set
For an unnecessary tag, agree on removal with its business owner and verify the affected journeys afterward. For a necessary integration, reduce unnecessary fields, control publishing access and document the actual limitations. Keep a rollback plan for operational problems without treating restoration of an unsafe configuration as the final resolution.
CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide. We bring practical Israeli website and digital-infrastructure knowledge to the review of browser controls, website integrations and account ownership. Begin with the website, relevant pages and business functions. Do not send live enquiry payloads, private session recordings or account credentials in the initial message.
Recheck when a vendor, container rule, plugin, form or consent configuration changes. The final record should identify approved scripts, owners, information categories, tested conditions and unresolved provider questions. It describes a bounded technical review, not a guarantee that every external service is harmless or a determination of legal compliance in every country.
