Third-party scripts inventory
Baseline before tightening CSP on www.
| Source | Use | CSP hints |
|---|---|---|
| googletagmanager.com | Ads / conversion | script-src allowlists |
| embed.tawk.to | Chat widget | frame + connect |
| client.hoststack.pro | Billing links | Navigate / form posts |
| UptimeRobot API | Status page | Prefer server-side fetch |
Rollout steps
- Deploy CSP Report-Only in staging; collect violations.
- Split
script-srcvsconnect-src; avoid*. - Document exceptions in changelog with
securitytag. - See CSP go-live playbook for phased enforce.
Flat-file mirror: docs/third-party-scripts-inventory.md.