# Frontend security: review every script that can change what a user sees

Source: https://www.web3sec.news/blog/frontend-third-party-script-security
Updated: 2026-11-08

Assign owners and record supporting evidence in your team's own system.

- [ ] Record browser-loaded scripts on sensitive user journeys.
- [ ] Name an owner and publishing authority for each integration.
- [ ] Remove a dependency without a present, specific purpose.
- [ ] Verify policy headers on the delivered response.
- [ ] Test real interactions with the policy enforced.
- [ ] Block an optional vendor in staging and verify core workflows still work.

## References
- [OWASP: third-party JavaScript management](https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html)
- [MDN: script-src policy behavior, hashes and nonces](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/script-src)