Checkout Page Audit Finds 23 Unapproved Third-Party Scripts Loading via Marketing Tag Manager

·3 views

A trade website's checkout page, which collects card details directly, was found to load 29 scripts, yet the team could account for only six. The remaining 23 arrived through a marketing tag manager, including advertising conversion pixels, a live chat widget, a reviews badge, and a session recording tool that did not mask card numbers. The discovery came as PCI DSS 4.0 requirements for script inventories and weekly change detection became mandatory at the end of March 2025. The company says no one acted dishonestly, but the setup let anyone with tool access alter the payment page without review. Remediation took about a month: the tag manager was removed from checkout, conversion tracking moved server-side, a content security policy was enforced, a nightly integrity check was added, and the recordings were deleted with written supplier confirmation.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Hoki: Open-source waving lucky cat app adds Windows and Android versions

Hoki, a virtual Chinese lucky cat (招财猫), has released version 3.2.0 with a Windows app featuring a live 3D desktop cat that follows the mouse. An offline Android app and home-screen widget are also available, along with an installable PWA. Tapping the cat gives a luck boost, and lucky numbers trigger a bell and blessing alongside a daily fortune. The Windows app is single-instance, so relaunching hands focus to the running app, and all data stays on the user's device with no account, ads, or tracking. The project is MIT licensed, written mostly in JavaScript, and hosted for free on GitHub Pages.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Docker network clash on integration host cut off carrier traffic after new project deployed

An integration host running partner adapters in Docker Compose lost connectivity to a carrier reached over a VPN after a new project was deployed. Docker automatically assigned the new project a subnet, 172.25.0.0/16, that overlapped with the carrier's address range, which the host's default gateway routed through the tunnel. The new local bridge route redirected the carrier's traffic into an empty network, so bookings timed out until the project was stopped. The team fixed the issue by setting Docker's default address pools to a reserved block, recreating existing projects, and adding a pre-start check that compares bridge subnets with partner ranges.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Identical Firewall Rules Behave Differently Across AWS, Azure, Google Cloud and Oracle

Copying a firewall rule between cloud providers can unintentionally widen access, even when the port and intent appear identical. AWS security groups are stateful and allow-only, while Azure relies on priority-ordered rules with explicit denies and built-in defaults. Google Cloud applies an implied egress allow at the lowest priority, which can undermine a deny-everything policy if egress is not handled explicitly. Oracle security lists are stateless by default, so a rule copied from a stateful platform can break return traffic and tempt teams into overly broad fixes. The article warns that translating security group references into broad CIDR ranges and differing logging behaviours can silently expand exposure and hide evidence until an audit or incident.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

What Is a Virtual Phone Number and Which Type Suits Your Needs

A virtual phone number is a genuine telephone number that is not bound to a specific SIM card, handset, or landline. The provider holds the number in software and routes each incoming call to a chosen destination, such as a mobile phone, a team line, a voice menu, or an AI agent. Callers dial it just like any other number, and the owner can change where calls go without changing the number. The article explains that 'free' numbers come in several forms, including trial access, bundled numbers on paid plans, and shared public numbers, with the last carrying a real security risk. It also notes that the best type depends on what callers should see and who pays, and advises verifying identity and checking messaging app support before going live.

0 comments Read more at DEV Community