Completed Third-Party Script Register

Purpose

Third-party scripts are frontend architecture dependencies. They affect performance, privacy, security, reliability, consent, incident response, and user trust. This completed register shows the minimum detail expected before scripts run on production routes.

Register

Script	Purpose	Routes	Business owner	Engineering owner	Data accessed	Consent	Load strategy	Budget	Kill switch	Review date
Product analytics SDK	product usage analytics	app-wide except sensitive denylist	product ops	data platform	typed events only	analytics	after consent where required; first-party collector	under route third-party budget	telemetry.analytics.enabled	quarterly
Session replay SDK	UX debugging	reports beta only	support ops	frontend platform	masked DOM, no billing/security routes	analytics/support	lazy load after route allowlist and consent	disabled by default on slow devices	telemetry.replay.enabled	monthly during beta
Support widget	in-app help	account support panel	support	account team	current route and support conversation only	functional/support	load on panel open	no initial route impact	support.widget.enabled	quarterly
Experiment SDK	controlled rollout	dashboard and acquisition routes	growth	experimentation platform	assignment id, exposure event	analytics	early but minimal bootstrap	under 10KB critical bootstrap	experiments.client.enabled	quarterly
Attribution pixel	campaign attribution	acquisition pages only	growth	growth platform	campaign source/trigger only	marketing	post-consent, not on authenticated app	not allowed in app shell	marketing.attribution.enabled	before each campaign

Denylist

Scripts may not run on:

• payment method edit routes
• password/security settings
• recovery flows
• support message editor
• admin impersonation mode
• GenUI approval screens for destructive actions

Required controls

• owner and route allowlist before launch
• consent category and regional behavior
• performance budget and load strategy
• CSP impact reviewed
• sensitive-data access reviewed
• kill switch tested in staging
• renewal date visible on scorecard

Drift monitoring

Track:

• script URL/hash changes
• unexpected network destinations
• tag-manager changes without engineering review
• transfer size and main-thread cost changes
• CSP violations related to vendor origins
• new cookies/storage keys created by vendors

Monthly review prompts

• Does the script still serve an active product or operational purpose?
• Did it create new cookies, storage keys, network calls, or CSP violations?
• Is the owner still correct?
• Did performance cost change?
• Are denylisted routes still blocked?
• Are consent requirements still correct?
• Has a safer first-party or server-side alternative become available?

Source lens

Use this register with Part VIII privacy/measurement architecture, the client-side security/privacy review packet, and the performance-critical lead funnel solution pack.