Answering a security questionnaire about an embedded script
What a reviewer wants to know before any third-party script goes on a company's site.
Last updated
What a reviewer is actually worried about
Underneath the spreadsheet there are three questions. Can this thing read the page it sits on. Can it change the page it sits on. Where does anything it collects end up. Everything else on the form is a way of asking one of those from a different angle, and a vendor answer that does not address them is a vendor answer nobody can sign off.
Reading and changing the page
A widget renders inside a shadow root opened on its own element, and the root's own rules start by resetting everything inheritable. So the host page's styles do not reach into the widget and the widget's styles cannot leak out into the host page, which is the half of this that vendors usually get wrong in the other direction. Nothing the widget loads comes from anywhere but our own origin, so adding one does not add a domain to anybody's content policy that they did not choose.
The part a vendor PDF cannot give you
Every saved widget carries a small record: whether anything in it is executed as author-supplied code, whether anything is applied as an author-supplied stylesheet, whether rendering it makes a visitor's browser talk to anyone but us, and whether an accessibility check was run against that exact configuration and when. It is recomputed on our side from the parsed widget on every write and never accepted from a client, so it describes the thing on your page rather than the product in general. That is the difference between an answer and a brochure.
What it is allowed to say no to
A widget built with a hand-written code block flips the first of those to false, and it should. A record that always said yes would be a record nobody bothered to read, and the reason to keep it small and boolean is that a score is a thing to improve while a boolean is a thing to check. If the answer for your widget is no, we would rather you found that on the page than in an audit.
What this is evidence from
- Shadow DOM, :host { all: initial }
- the isolation mechanism named rather than gestured at, checked against the shipped renderer by a test
- 18.8 KB gzipped
- the size of the one file a reviewer's site would be downloading, measured from that file
lib/schemas/widget-guarantee.ts- the record itself, its four claims, and the rule that it is derived on our side rather than sent by a client
app/api/v1/embed/widgets/route.ts- the endpoint a customer's page calls, and the only request a widget makes that is not for our own static file
Related writing
- The European Accessibility Act and the widgets on your siteWhose problem an embedded widget is, since June 2025.
- Running custom code on someone else's pageWhere hand-written code runs, and why it is not your page.
- We measure our own site, and your visitors are a different questionOur analytics and your widget are not the same claim.