PCI DSS 6.4.3 Payment Page Script Lint

Five lines that a payment-page developer writes without thinking each fail PCI DSS 4.0.1 Requirement 6.4.3 - a tag manager tag, a sha1- integrity hash, an @latest CDN pin, an inline onclick, and a card number written to localStorage. Since March 2025 they are no longer future-dated, so in 2026 every assessment is scored against them in full and there is no grace period left to invoke.

Requirement 6.4.3 asks for three things about every script on a payment page: an inventory, a written business justification, and a method that assures the script has not been tampered with. Requirement 11.6.1 asks you to detect unauthorised changes to the page content and the HTTP headers as the browser receives them. Both apply to merchants who thought an iframe put them out of scope - since v4.0.1 that includes SAQ A.

Here is what fails, and what passes:

<!-- fails 6.4.3: content can change under you, so neither the authorisation nor the change detection holds -->
<script src="https://cdn.jsdelivr.net/npm/chart.js@latest/dist/chart.min.js"></script>

<!-- passes: exact version + a digest the browser enforces -->
<script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/chart.min.js"
        integrity="sha384-..." crossorigin="anonymous"></script>

The subtle one is crossorigin. An integrity attribute on a cross-origin script does nothing at all unless crossorigin is also present - the browser silently skips the check. The page looks compliant in a code review and is not.

The second subtle one is the tag manager. A container script is a single line in your source, but it injects further scripts at run time, which means the list of scripts on your payment page cannot be derived from the page source at all. Either move it off the payment page, or inventory and authorise every tag inside the container.

The third is your inventory file itself. An inventory with a URL but no justification and no authorized_by is not an inventory, it is a list. Entries whose justification says TBD are the ones an assessor reads first.

This extension carries 29 checks: 21 that read the page source, and 8 that read a script-inventory JSON and report which entries are missing a justification, an authorisation, an integrity method, or a review date. It runs in VS Code, and the same 29 checks run in the browser on a free page with nothing uploaded - the source never leaves the machine, which matters when the file is a live checkout template.

Free covers one page completely, with every finding shown in full. A licence adds the whole repository, the CSV/JSON/HTML evidence export, re-checking on save, and a JSON report for CI. Script-monitoring services built for these two requirements run $99 to $999 per month; this is $29 once.