Detect all the scripts running on your pages

Get ready for PCI DSS V4 compliance with a complete inventory of scripts running on your pages.

Setup: add report-sha256 (or report-sha384/report-sha512) to your CSP.

Less chasing. More control.

Script Inventory turns “what scripts run on this page?” into a simple, shareable view so audits and reviews don’t derail releases.

A single inventory sourced from real traffic: scripts, origins, and hashes. Faster answers to “what changed?”

Spot risky changes earlier with hash changes and known CVE signals. Prioritize fixes before they become findings.

Standardize evidence across environments as teams and vendors grow without spreadsheet workflows.

“We finally had a clear list of scripts, hashes, and what changed week to week.”
Beta tester, Security Engineering Manager

100%

visibility of scripts loaded on your pages

Collect integrity reports and turn them into an always-current script inventory.

1
Connect your application
Add our reporting endpoint to your CSP. Browsers send integrity reports as pages load.
2
View reports and metrics
See scripts, origins, URLs, and unique hashes with flexible date ranges.
3
Drill into origins and scripts
Drill into per-origin and per-script details, including known CVE signals.
4
Track over time
Track changes over time and catch unexpected additions quickly.

Technical call-out

Minimal example to start collecting integrity reports (adjust directives and endpoint).

Replace <your-endpoint> with your CentralCSP reporting endpoint.

Content-Security-Policy:
  default-src 'self';
  script-src 'self' 'report-sha256';
  report-uri https://report.centralcsp.com/<your-endpoint>;

Add reporting, choose a hash algorithm, and you’re collecting inventory data.

Side-by-side: manual discovery vs. observed data.

Metric	Manual / Legacy process	CentralCSP Script Inventory
Speed	Slow discovery across teams and pages. Re-check after releases.	Updates continuously from real traffic. Changes show up automatically.
Accuracy	Easy to miss injected scripts and dynamic loaders. Docs drift.	Built from observed loads so it matches what actually runs.
Visibility	Hard to see origin, changes, and risk.	Origin, URL, hash, changes, and known CVE signals per script.
Effort	Manual evidence collection before assessments.	Evidence on demand with low ongoing overhead.