Writing for compliance, security and engineering teams
Specific, cited, and honest about what we sell. Every post answers its question in the first sixty words and carries ten questions at the end.
PCI DSS
The requirements themselves, what changed, and how to produce evidence an assessor accepts.
PCI DSS compliance: a practical guide for 2026
What the standard covers, what changed in v4.0.1, and where the two client-side requirements fit.
PCI DSS 4.0.1 requirements: what changed and when
The changes that matter, the dates that already passed, and the two requirements most teams missed.
How to comply with PCI DSS 6.4.3 and 11.6.1
A step-by-step method, from defining payment-page scope to handing an assessor the evidence.
SAQ A and the script requirements: who is exempt
The January 2025 carve-out is narrower than most people think. Here is what it actually says.
PCI compliance cost: where the client-side line item lands
What drives the bill, which costs are one-off, and how the 6.4.3 and 11.6.1 line compares.
How to build a payment-page script inventory
Start from what actually executed, not from the tags you remember adding.
Hosted payment pages, iframes and PCI scope
Why embedding your provider's iframe reduces scope without removing the parent page from it.
Attacks
What actually happens on a compromised checkout, and how each technique is detected.
What is Magecart? Groups, methods and real incidents
Where the name came from, how the attacks work, and why they run for months undetected.
What is web skimming? How card data leaves the browser
The technique, the exfiltration methods, and why your server logs show a successful checkout.
What is formjacking? The mechanism, explained
How a script hijacks a form, the two main implementations, and what detects each one.
Shadow code: the scripts nobody approved
Code executing on your pages that no one on your team chose, and how it gets there.
Homoglyph attacks: when a domain is not the domain
Characters that render identically, and why they work so well against script allowlists.
JavaScript injection attacks, explained
How arbitrary script gets onto a page you control, and the four routes that matter.
Technical
CSP, SRI, obfuscation and the controls around scripts, explained properly.
Content Security Policy: a complete guide
What a CSP does, how to deploy one without breaking your site, and the gap it leaves open.
CSP vs script monitoring: two controls, different jobs
One governs where scripts come from. The other governs what they do. You want both.
Subresource Integrity: what SRI solves and what breaks
Why SRI is excellent for static assets and almost unusable for third-party tags.
JavaScript security: the client-side threat model
What actually goes wrong in the browser, and which controls address which failure.
JavaScript obfuscation and de-obfuscation
Why malicious scripts are obfuscated, the common techniques, and how they get unpacked.
How to deobfuscate JavaScript, step by step
A working method for the case that matters: an unreadable third-party script on a page you are responsible for.
Tag manager security: GTM, Adobe and Tealium
A tag container is a mechanism for injecting arbitrary JavaScript. Secure it accordingly.
Platforms
Where compliance responsibility falls on hosted and self-hosted ecommerce platforms.
Comparisons
Honest roundups and pricing guides, with our own bias disclosed.
Best client-side security tools in 2026
Thirteen tools, each with real pros and real cons, and an honest statement of our own bias.
Does Cloudflare make you PCI compliant?
What the WAF, the CDN and Page Shield each do for 6.4.3 and 11.6.1, and what they leave with you.
Best PCI compliance software in 2026
Full-scope platforms and client-side tools are different categories. Both lists, kept apart.
Jscrambler pricing: what is published, and what is not
No public figures, what drives a quote, and what to ask for on the call.
Feroot pricing: what is published, and what is not
Tier names with no figures, what drives the quote, and what DXSecure actually costs.
Reflectiz pricing: what is published, and what is not
Quoted by flows and scan interval. What drives it, and what to ask for on the call.
Source Defense pricing: four published tiers
From $98 a month. What each tier includes, and where the domain and payment-page caps bite.
Cloudflare Page Shield pricing: bundled, then an add-on
Script monitoring is included. The alerts PCI 11.6.1 needs are not.
See every script on your own checkout.
Install the tag, mark your payment pages, and watch the inventory fill in. Free forever on 1,000 page views a month, no credit card.
Free forever plan. No credit card.