Third-Party Script, Payment Gateway & Tag-Manager Drift Watchdog

Verified every 5m on https://apexclimate.com for HTTP 200 load and clean DOM mount.

Accidental CSP header tightening, unauthorized third-party script injection on payment pages, or unmounted Stripe iframe elements silently block card checkout.

Flags unexpected third-party <script src> injections or CSP form-action blocks immediately.

2. Four Script-Integrity & CSP Guardrails (Stripe.js & Payment Element Checkout)

• 1. Authorized Script Inventory Baseline (PCI-DSS v4.0 Req 6.4.3 & 11.6.1 Script Integrity): Inventories every external <script src> loaded on https://apexclimate.com and alerts immediately if an unknown third-party domain or unauthorized GTM tag appears.
• 2. Sub-Element & Iframe Mount Verification (iframe[name^='__privateStripeFrame'], form[action*='/checkout'] button[type='submit']): Asserts that https://js.stripe.com/v3/ not only returns HTTP 200 but successfully mounts its interactive DOM/iframe container without throwing console ReferenceError/TypeError exceptions.
• 3. CSP & form-action Regression Detection: Verifies that Content-Security-Policy script-src, frame-src, and form-action directives never block legitimate checkout or lead-form submissions after a deployment.
• 4. Continuous 5m Canary Cadence: Executes automated script-integrity and DOM-mount assertions every 5m with instant email/webhook escalation when a third-party widget fails to initialize.

# Minimal-Privilege PCI-DSS v4.0 CSP Header for apexclimate.com (Stripe Checkout / Stripe.js)
Content-Security-Policy:
  default-src 'self';
  script-src 'self' https://js.stripe.com;
  frame-src 'self' https://js.stripe.com https://hooks.stripe.com;
  connect-src 'self' https://api.stripe.com;
  form-action 'self' https://checkout.stripe.com;

Attach this script-inventory and DOM assertion manifest (onbits-script-watchdog.json) to your 30-Day OnBits Monitor Pilot:

{
  "watchdog_id": "script_integrity_guard_apexclimate.com",
  "target_domain": "https://apexclimate.com",
  "gateway_profile": "stripe-js",
  "schedule_interval": "5m",
  "authorized_script_origins": [
    "https://apexclimate.com",
    "https://js.stripe.com/v3/"
  ],
  "dom_mount_assertion": {
    "required_selector": "iframe[name^='__privateStripeFrame'], form[action*='/checkout'] button[type='submit']",
    "max_mount_wait_ms": 4000,
    "fail_on_console_error": true,
    "fail_on_csp_violation": true
  },
  "alert_policy": {
    "notify_on_unauthorized_script_origin": true,
    "consecutive_failures_threshold": 2
  }
}