Third-Party Script and Supply Chain Risk Review
Assess what external code runs on your pages.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
Assess the risk from external scripts and services my pages load. Site and type of data it handles (logins, payments, personal data): [SITE_AND_DATA]. List of third-party scripts, tags, widgets, fonts, and embeds with their purposes (from the tag manager, page source, or network tab): [THIRD_PARTY_LIST]. Return tables: 1. Inventory: Script or service | Provider | Purpose | Where loaded (all pages, checkout, login) | Loaded how (tag manager, direct, iframe) | Business owner | Still needed? (yes, unknown, no). 2. Risk assessment: Script | Access (can it read forms, cookies, page content?) | Data shared | Change control (can the provider change code without my review?) | Performance cost | Privacy and consent issue | Risk (1-5). 3. Controls: content security policy rules, subresource integrity where code is static, loading in iframes with sandbox, removal from sensitive pages (checkout, login), consent gating, and a vendor review. 4. Action list: remove, replace, restrict, or keep with monitoring. Provide a monthly review routine and an approval policy for adding a new third-party script (who approves, what is documented). Emphasize that scripts on payment and login pages deserve the strictest scrutiny.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.