Why we don't block
The most common question in a sales call: can you just stop the bad script from running? We can. We choose not to, and the reasoning is worth writing down because it is the decision that most shapes the product.
The scenario that decided it
It is the second week of December. A retailer is doing four times normal volume. A monitoring tool detects a modified script on the checkout and automatically blocks it.
Two possibilities. Either it was a skimmer, and blocking saved a great deal of money. Or it was the payment provider's own library, updated on a schedule the retailer did not know about, and checkout is now broken at peak for everyone, and the people who could diagnose it are on a plane.
The tool cannot tell those apart reliably. It is making a decision whose downside it does not bear.
The asymmetry nobody prices
Vendors quote detection accuracy as though a false positive and a false negative were comparable errors. On a payment page they are not remotely comparable. A missed skimmer leaks card data at a rate measured in transactions. A false block stops revenue at a rate measured in all of them.
Those costs are not only different in size, they are different in shape, and the shape depends on the business — which we do not know and the retailer does.
What we do instead
We make the alert good enough that a human decision takes seconds rather than an investigation. The alert names the script, the vendor, what changed, when, and what it started doing that it did not do before. A person who is paged at 3am should be able to decide from the message alone.
That is a harder engineering problem than blocking. "Something anomalous" is easy. "This script, from this vendor, began reading the CVV field at 14:06" is not, and it is the only version that makes a person faster rather than more anxious.
Where we would change our mind
If a customer wants blocking, has thought about the failure mode, and asks us to build it behind their own policy, that is a reasonable thing to want and we would build it. What we will not do is make it the default, or imply that automation removes the judgment call. It relocates it — to us, at a moment when we know least.