For security teams who want the payload, not a ticket
An alert that says 'suspicious activity detected' starts an investigation. An alert with the script, the hash, the call stack and the archived payload ends one.
Start for free
Talk to an expert
What does security get from script monitoring?
Each recorded behaviour carries a call-stack trace naming the script URL, its content hash, and the line and column. An alert that says 'suspicious activity detected' starts an investigation. An alert with the script, the hash, the call stack and the archived payload ends one. The rest of this page sets out what that means day to day.
Evidence attached to the alert
Each recorded behaviour carries a call-stack trace naming the script URL, its content hash, and the line and column. The archived payload is the actual code.
Detection off the page as well as on it
A range of detections run against the copy we fetched ourselves, so a script that avoids in-page hooks still leaves a content hash and a diffable payload.
Four blocking granularities
Domain, URL, payload hash, or a single capability. The last one lets you keep a vendor while removing its access to the card field.
It goes where you already work
Three channels, no more: email, a webhook that reaches Slack, Jira, Discord or anything else accepting an HTTP request, and hourly CSV batches to S3 for your SIEM. Not another dashboard to remember to check.
Blocking by hash pins the exact payload you approved, so a vendor that ships new code has to be re-approved rather than silently inherited.
Frequently asked questions
Read the FAQ
Enough to act: the script URL, its content hash, the call stack with line and column, the behaviour observed, the page, the session count, and the archived payload.
Partly, and precision matters more than reassurance here. The in-page engine is a first-party script and is visible like any client-side product, so a determined attacker can study it. Harder to defeat quietly is the record: behaviours tie to the content hash of the script that ran, a range of detections run off the page against our own fetched copy, and an anti-tamper package makes the in-page detections materially harder to manipulate.
No, and it does not overlap with one. A WAF inspects traffic arriving at your application. This observes code executing in the browser, where that traffic never goes. They cover different halves.
Yes, through the webhook or the hourly S3 CSV batches, both on Pro and Enterprise. Those two plus email are the three channels, and there is no separate per-platform integration list.
This is what the archive is for: payloads are kept, so you can diff the malicious version against the version you approved and see exactly what changed and what it was designed to collect.
Try it on your own payment pages.
Free forever on 1,000 page views a month, no credit card.
Free forever plan. No credit card.