The eleven scripts nobody remembered adding
We have now run first inventories on enough storefronts to say something with confidence: the number of scripts executing on a checkout page is larger than the number anyone at the company believes, and the gap is remarkably consistent. Eleven is our median surprise — eleven things running that nobody in the room could account for.
They are not usually sinister. That is the point worth sitting with.
Where they come from
Almost none get added by a person deciding to add them. A marketer installs a tag manager, correctly, with approval. The tag manager loads a heatmap tool. The heatmap tool loads a session recorder from a different domain. Two years later the marketer has changed jobs, the heatmap contract lapsed, the tag stayed, and the vendor sold the business.
Every step in that chain was reasonable. Nobody skipped a review. The end state is still a payment page executing code from a company nobody at the retailer has ever spoken to.
Why the usual tooling misses it
A dependency scanner reads your manifest. None of this is in your manifest. A code review covers your repository. None of this is in your repository. A vulnerability scan checks your servers, and this code never touches your servers — it goes from a third party's CDN to your customer's browser, and the only machine that ever sees the two together is the one you have the least visibility into.
This is why the question "is our checkout secure?" is so often answered confidently and wrongly. Everything the company can see is fine.
What to do about it this week
You do not need us to start. Open your checkout in a browser, open the network tab, filter to scripts, and write down every domain. Then take that list to whoever owns marketing and ask them to name each one. The conversation that follows is the valuable part, and it costs an afternoon.
What you will probably find: two tools you are still paying for and not using, one you cancelled that is still loading, and at least one domain nobody can identify at all. Deal with the third one first.
The wider lesson is not that retailers are careless. It is that the default state of a storefront is accumulation — things get added and nothing is designed to remove them. Absent a process that prunes, the list only ever grows, and it grows in the part of your stack that touches card data.