Documentation & resources
Installation, the data model, and two guides that are useful whether or not you ever run this product.
Getting started
- Install the collector — one script tag, a tag manager container, or a CDN worker. Pick the one that does not require a release.
- Confirm collection — the first inventory appears within minutes. If it is shorter than you expected, you are probably looking at a page that is not the checkout.
- Agree the baseline — the part that needs a person, and the part worth doing properly.
- Route alerts — see integrations. Start with one channel.
Reference
- Data model — scripts, baselines, deviations, approvals. Four objects, and the relationships between them are the whole API.
- Webhook payloads — versioned, with a changelog. We do not change a payload shape without a version bump.
- Evidence export format — what an assessor receives, and what each field means.
- Retention and residency settings.
Guides
- How to run a script inventory — vendor-neutral. You can do this by hand.
- PCI DSS 4.0 script requirements — what an assessor asks for.
- A sensible October — the freeze checklist.
Writing
Longer thinking, mostly from incidents, is on the blog.