Script inventory, every third-party script your site loads
Every script real browsers load on your site, first party and third party, grouped by origin, with hash history and the library behind each one.
Last update:
The script inventory is the list of every script browsers executed on your website. Each script is keyed by its URL and grouped under the origin that served it. It is the client-side dependency list of your site, observed from real page loads rather than assembled from your build.
It has two halves, and both come from the same Content Security Policy (CSP) reports:
- CSP hashes answers which scripts run, from which origins, on which pages, and whether the content at a URL changed.
- Technologies answers what each of those scripts is: the library, its version, whether that version is still current, and the known Common Vulnerabilities and Exposures (CVE) entries affecting it.
Where the script inventory comes from
Browsers report a hash of every script they execute when your CSP carries 'report-sha256'. Each of those csp-hash reports names the script URL, its hash, and the page the browser was on.
Add the keyword to script-src and reports start arriving on the next page load. For more information, refer to Connect your site.
There is nothing to install: no crawler to schedule, no agent on the page, no repository to connect. The inventory is built from what visitors' browsers did.
What the inventory records
For every script URL, CentralCSP keeps:
| Field | What it tells you |
|---|---|
| Origin | The host that served the script, which is the unit of trust |
| Current hash | The content browsers are executing right now |
| Hash history | Every hash seen at that URL, with first and last seen |
| Pages | The document URLs the script was loaded on |
| First and last seen | When the script entered the inventory, and whether it is still loading |
Origins are the top level of the list. You read it as "11 hosts execute code on my site" before you read it as a list of files.
The technology layer adds, per script, the library it carries, the version, the lifecycle status of that version, and the CVEs that affect it. For more information, refer to Technologies.
What you use the inventory for
- Know your client-side dependencies. The inventory includes vendor tags, CDN copies, and anything a tag manager injected at runtime, which a scan of your source tree never lists.
- See change. One URL with several hashes means the content at that URL changed. That is routine for your own bundle after a deploy, and worth a question for a third-party script sitting at a stable URL.
- Judge an origin, not just a file. Grouping by origin turns a long file list into a short list of parties you either trust or do not.
- Find vulnerable versions. A known CVE in a library your visitors load is visible without waiting for a dependency scan that never saw the script. For a one-off check of a single page, the free Technology Checker does the same from a URL.
Coverage and limits
The inventory covers what browsers report, which has three consequences:
- A page nobody visited, or a page that does not carry the policy, contributes nothing.
- A script appears shortly after a browser first executes it, not when you deploy it.
- Only scripts loaded from a URL are matched to a library and version. Inline scripts are not part of the technology layer.
Reports are kept for 90 days, so the hash history goes back that far.
Next steps
Evidence export
Export a ZIP holding a PDF report and two complete CSVs. What is in each file, what is truncated in the PDF, and what is not.
Overview
Technologies lists every JavaScript library your visitors load, with version, lifecycle status, and known CVEs, from CSP hash reports. No agent, no crawler.