Checkout Monitor

Every script that executes on your payment page, what it was authorized to do, and the moment any of that changes.

What it does

Kyklosec inventories every script on a checkout page and flags any change to one inside the session it happens. The inventory covers what actually runs in the customer's browser, including scripts loaded by other scripts, which is where the list usually stops matching anyone's expectations.

From that inventory we build a baseline: for each script, the domain it came from, what it reads, and where it sends anything. A change to any of those three is an alert. A new script nobody added is an alert. A script that has always been there and starts reading form fields it never read before is the alert that matters most, and it is the one a file-hash check will miss entirely, because the file did not change — the behaviour did.

PCI DSS 4.0, specifically

Requirements 6.4.3 and 11.6.1 ask you to manage the scripts on your payment pages and to detect unauthorized changes to them. Most teams meet this with a spreadsheet and a quarterly review, which satisfies an assessor and nobody else.

Checkout Monitor produces the artifact instead of the paperwork: a live inventory with a justification field per script, a change log with timestamps, and an export your QSA can read. We are not going to tell you it makes an assessment painless. It makes the evidence real, which is a different and better claim.

What it does not do

• It does not block. It watches and tells you. Blocking a payment script on a live storefront during peak season is a decision a person should make.
• It does not review your own code. Your CI does that better.
• It does not replace a CSP. It tells you what your CSP is actually allowing, which is usually more than its author intended.

Getting it running

One tag, or a line in your existing tag manager. Most stores have a first inventory inside ten minutes and spend the following week deciding what to do about the eleven scripts they did not know were there.