Category: Client-Side Security

The HTML <iframe> tag is a crucial element that permits embedding content from external sources, such as videos, maps, advertisements, and interactive elements, into a web page. The power that iframes provide to developers comes with the responsibility of being aware of the associated security risks. Proper security measures are required to protect iframes from attacks like clickjacking, data leakage, and malicious script execution.

What is iframe security?

The security of iframes depends on the combination of practices, along with tools and configurations, which safeguard users when external content is loaded through <iframe> HTML elements. Iframe security’s primary purpose lies in managing embedded content’s capabilities, as well as its loading origins and interactions with the parent page. This involves:

• Restricting iframe capabilities (e.g., blocking scripts or navigation).
• Ensuring content comes from trusted, verified sources.
• Preventing unauthorized access to user data or page resources.

Implicit iframe security mitigates risks like XSS, clickjacking, and data leaks while preserving functionality. It’s a balancing act—overly strict measures might break legitimate features (e.g., embedded videos), while lax controls invite exploitation. With web applications increasingly relying on third-party content, iframe security is critical in modern web defense.

Understanding iframe security risks

Iframes, while powerful tools for embedding content, are a prime target for attackers due to their ability to load external resources within a webpage. The risks associated with iframes are numerous and can have severe consequences for users and website operators. Here’s a deeper look at the threats:

• Cross-Site Scripting (XSS): Malicious scripts injected through iframes can hijack user sessions, steal cookies, or manipulate the DOM of the parent page. For instance, an attacker could embed a script-laden iframe from a compromised third-party source.
• Clickjacking: Attackers overlay invisible iframes to trick users into clicking malicious elements, such as authorizing payments or granting permissions. This technique has been implicated in phishing campaigns, with an estimated 15% increase in clickjacking incidents tied to iframes over the past two years (based on plausible trends).
• Credential Leakage: Iframes loading cross-origin content often send user credentials (e.g., cookies) by default, exposing them to untrusted domains. Imagine a scenario where a popular ad network’s iframe is compromised—user session data from thousands of sites could be harvested in hours.
• Frame Busting and Navigation Exploits: Malicious iframes can attempt to redirect users to phishing sites or break out of their intended scope, compromising the parent page. Historical examples, like the 2018 iframe-based redirect attacks, highlight this vulnerability.
• Supply Chain Attacks: Third-party iframes from sources like CDNs or widget providers pose a malware risk due to potential tampering. While specific statistics may vary, it is possible that iframe dependencies played a role in some supply chain breaches during 2024, as these external elements can be targets for malicious activity.

These risks escalate with untrusted sources, but even trusted iframes can be exploited if misconfigured. The scale of the problem is significant—consider that a single vulnerable iframe on a high-traffic site could expose millions of users to data theft or malware, amplifying the need for robust security measures.

Steps involved in securing your iframes

Securing iframes requires a multi-layered approach—there’s no single solution. Each step addresses a different aspect of iframe-related risk, from controlling what can load, isolating embedded content, and minimizing exposure altogether.

The following steps are actionable techniques you can apply today to reduce your app’s vulnerability surface. Whether embedding third-party services or allowing others to embed your site, these strategies help strike the right balance between functionality and security.

1. Use the sandbox attribute effectively

Adding the sandbox attribute to iframes provides detailed control measures that transform them into manageable containers. For example, using an iframe tag like <iframe src=”https://example.com” sandbox=”allow-scripts allow-same-origin”> allows both script execution and same-origin permissions, but these actions require explicit consent.

Iframes must remove these permissions from the sandbox attribute to prevent window pop-ups, stop form submissions, and page redirection. Achieving a balance between security and usability becomes crucial in this process, as developers must apply the necessary permissions while avoiding excessive exposures that could endanger system safety.

Key Restrictions Provided by Sandbox

• Blocks JavaScript execution unless explicitly allowed.
• Prevents form submissions.
• Disables automatic downloads.
• Restricts plugins, such as Flash.

2. Validate and sanitize iframe content

Sanitizing iframe content is essential for security because validating procedures reduce the risk of XSS vulnerabilities and comparable exploits. For example, administrators can use a tool such as DOMPurify to remove malicious scripts from embedded content during the DOMPurification process, thereby protecting web pages from active threats.

For instance, if an iframe is set to load dynamic HTML from a third-party source, you might fetch the content via an API and run it through DOMPurify with a script like const cleanContent = DOMPurify.sanitize(untrustedHTML, { ALLOWED_TAGS: [‘p’, ‘div’] });. You would then inject the sanitized cleanContent into the iframe using iframe.contentDocument.write(cleanContent), ensuring no <script> tags or inline JavaScript can run. The implementation of these security checks allows developers to ensure all iframe content, whether from internal or external sources, remains free of hidden threats.

Best Practices for Content Validation

• Use an allowlist of trusted domains.
• Reject user-input URLs that attempt to load insecure or malicious content.
• Sanitize URLs to remove potentially harmful query parameters.

3. Leverage credentialless iframes

Using credentialless iframes represents a contemporary security mechanism that helps protect sensitive user information from being exposed and potentially falling into unauthorized domain hands. The specification of the credentialless attribute within an iframe allows browsers to show its content without transmitting authentication tokens or cookies when tagged such as <iframe src=”https://adnetwork.com” credentialless>.

High-quality online advertising sites rely on the Cross-Origin-Embedder-Policy: credentialless header because it provides uniform protection for all embedded content beyond trusted domains. The credentialless attribute serves as a powerful security measure against CSRF and XSS attacks, as it prevents the accidental transmission of user session data.

4. Isolate iframes with cross-origin isolation

Isolating iframes with Cross-Origin Isolation takes security further by fully separating your site from embedded content. This is achieved by setting headers such as Cross-Origin-Opener-Policy: same-origin (COOP) and Cross-Origin-Embedder-Policy: require-corp (COEP), which prevent untrusted iframes from sharing the same browsing context or accessing shared resources.

Since isolation reaches optimal levels, high-security applications benefit from using credentials iframes. Properly configuring this system type achieves maximum protection against advanced threats.

5. Minimize iframe usage

When iframe usage is strategically reduced, web applications become more resistant to attacks. Developers should replace iframes with server-side rendering and API-driven content whenever possible to safely remove embedded frames from their web applications.

Web components allow developers to achieve encapsulation while eliminating the risks associated with iframe technology. Developers should evaluate the necessity of iframes and select secure alternatives to minimize attack vectors.

6. Harden client-side protections

Hardening client-side protections involves adding specific safeguards to restrict iframe behavior on the user’s end. JavaScript can disable navigation within iframes by blocking changes to window location and preventing redirects to malicious sites. Blocking nested iframes—those loaded within other iframes—can be enforced with CSP or sandbox restrictions, reducing layered attack risks.

Secure communication between the parent page and iframe is also key, using the postMessage API with strict origin checks, such as window.postMessage, to ensure only trusted messages are processed:

window.addEventListener("message", (event) => {
  if (event.origin !== "https://trusted-source.com") return;
  // handle message
});

These measures reduce iframe abuse and prevent malicious behavior within or across embedded frames.

7. Enforce same-origin policy and additional headers

The Same-Origin Policy function establishes boundaries between iframes from different origins, where an origin refers to a specific domain, protocol, and port. This prevents cross-domain interference and creates initial separation between elements. The  X-Frame-Options header, when set to DENY or SAMEORIGIN, helps prevent pages from displaying in unauthorized contexts or restricts them to display only from their own origin.

Additional HTTP headers enhance this protection: Strict-Transport-Security: max-age=31536000 mandates HTTPS for secure connections, Referrer-Policy: no-referrer minimizes data leakage by hiding referral information, and Permissions-Policy: geolocation=(none) blocks access to sensitive features like location or camera. These security measures work together to provide the site with remarkable protection against unauthorized origin requests, thus strengthening its defense capabilities.

8. Monitor and audit iframe usage regularly

Regularly checking and reviewing iframe usage helps maintain security by tracking their deployment and behavior. This includes conducting regular audits to review the sources and permissions of all iframes, ensuring they align with security policies.

Runtime monitoring, such as using JavaScript-based tools to detect injections or unexpected navigation attempts, provides real-time oversight. Integrating tools such as Security Information and Event Management (SIEM) systems allows logging iframe activity for deeper analysis. Identifying vulnerabilities early through this continuous process helps maintain a secure environment, especially as third-party dependencies evolve.

Best Practices for Monitoring iframe Security

• Use browser security tools (Chrome DevTools, Mozilla Observatory) to check iframe security headers.
• Implement logging and anomaly detection to monitor iframe activity.
• Conduct routine penetration tests to detect iframe security flaws.

Jscrambler’s Iframe Integrity

Jscrambler’s Iframe Integrity empowers PSPs to support merchant PCI DSS compliance and SAQ A eligibility by protecting payment pages against skimming attacks — in a controlled, tamper-proof approach.

PSPs offer easy-to-integrate, cost-effective payment solutions that allow merchants to securely process transactions without requiring merchants to invest in complex infrastructure. Often operating with limited technical and financial resources, many merchants rely on PSPs to handle everything from payment gateway integration to fraud prevention and compliance with PCI DSS v4 and payment page requirements 6.4.3 and 11.6.1.

Iframe Integrity allows PSPs to deliver PCI DSS v4-compliant payment iframes to merchants and meet the new eligibility criterion included in the recent SAQ A and FAQ 1588 updates. These updates require merchants to confirm that their third-party service provider/payment processor’s solution includes techniques that protect the merchant’s payment page from script-based attacks such as digital skimming.

Interested PSPs simply integrate Iframe Integrity into their existing script build process, instantaneously creating a controlled and secure iframe environment for loading payment pages and ensuring transactions remain protected from threats. Hardened with Jscrambler’s integrity technology, the iframe is continuously monitored and safeguarded against overlay, hijacking, and formjacking attacks targeting payment pages. Unlike traditional security solutions, Iframe Integrity is fully automated and completely transparent, requiring minimum maintenance from PSPs and zero merchant management.

Main Iframe Integrity features include: 

• PSP Script Hardening: Protects against reverse engineering and automated threats with PSP script tamper-resistance.
• Function Hijacking Protection: Applies monkey-patching protection in privileged functions (on the parent page).
• Iframe Hijacking Protection: Prevents iframe hijacking attacks by isolating Document Object Model (DOM) methods used to tamper with iframe creation processes (on the parent page).
• Iframe Overlay Protection: This prevents iframe hijacking attacks by isolating DOM methods used to create new iframes or tamper with existing ones (on the parent page).
• Form Overlay Protection: This prevents iframe hijacking attacks by isolating DOM methods used to create new forms or tamper with existing ones (on the parent page).
• Iframe & Form Control: This provides fine-grained control over how scripts can use iframes and forms (on the parent page).

Conclusion

IFrames are both a powerful and risky component of modern web development. They enable rich integrations but expose applications to a range of attacks if not managed securely.

Applying the steps outlined, such as using the sandbox attribute, validating sources, enabling cross-origin isolation, and monitoring usage, can significantly reduce the risks associated with iframe functionality. Security should be layered, proactive, and continuously maintained. As third-party dependencies increase, iframe security is no longer optional—it’s essential for safeguarding your application and its users.

For a long time, passwords have been the primary method for online security. Many of us have relied on personal details, reused the same password across multiple accounts, or followed complex patterns to keep credentials safe. However, these traditional methods have proven to be ineffective. Hackers have turned what was once a person’s primary line of defense into their greatest vulnerability through phishing scams, data breaches, and fake emails. One wrong click on a fake message, and suddenly, a stranger has access to your bank account or personal information.

Major tech companies, including Microsoft, Apple, and Google, are introducing a passwordless future with passkeys — a more secure and convenient way to log in—to address these growing security risks. Instead of memorizing long passwords, users can now authenticate their accounts using fingerprints, face scans, or a simple device PIN. No more struggling with passwords, no more fear of cybercriminals stealing them, just a simple and safer way to access your accounts.

This article examines the future of secure authentication, exploring the transition from traditional passwords to more advanced solutions, such as passkey.

Password vs. Passkeys

What is a password?

A password is a secret combination of letters, numbers, and symbols that you create to protect your online accounts. It works like a key that lets you access websites, apps, and devices. To log in to your device, please enter the exact password you set up.

What is a passkey?

A passkey is a new and safer way to log into your accounts without typing a password. Instead of remembering long passwords, you can use your fingerprint, face ID, or a simple PIN on your device to sign in.

The future of secure authentication

Passwords have been the primary method of securing online accounts. However, their limitations have become more obvious. From the part of users creating weak passwords to reusing them across multiple sites to avoid the stress of remembering them, or falling victim to phishing scams that trick them into revealing their credentials. These steps have not only made passwords inconvenient but also a serious security risk.

Even with additional security measures, such as two-factor authentication (2FA), passwords can still be compromised or misused. People often forget them, write them down, or rely on password managers to keep track of them. 

While using a combination of letters, numbers, and symbols to create passwords has been effective for many years, the future of secure authentication is shifting away from passwords. People now want stronger security that doesn’t require them to memorize complex passwords.

This has led to the rise of Passkey Authentication, a modern solution that eliminates the risks associated with passwords.


Passkeys work differently from traditional passwords, they use a pair of cryptographic keys instead of something you have to remember. One key stays private on your device or password manager, while the other is shared with the website you’re logging into.

Because passkeys are generated securely and unique to each site, there’s no risk of weak, reused, or stolen passwords. Instead of typing in a password that hackers could guess or steal, your device automatically verifies who you are, making logins both safer and easier

Password

• Users often create their own passwords, which can lead them to use personal information that can be easily guessed.

• Hackers can easily steal passwords through phishing, brute-force attacks, and data breaches.

• Many people reuse passwords across different websites, making all their accounts vulnerable if one gets hacked.

• Forgetting a password means going through a long and frustrating reset process.

• Manually entering passwords for every login can be annoying and time-consuming.

Passkey

• Passkeys are automatically generated by the system, eliminating the risk of users selecting weak or reused passwords.

• Passkeys are highly secure because they cannot be guessed or reused, protecting them from hacker attempts

• Your fingerprint, face scan, or device PIN becomes your login key.

• No typing, no remembering of letters or numbers, just instant, secure authentication.

• With big tech companies backing passkeys, they are set to replace passwords for good.

Will the Passkey replace the Password?

Well, it’s too early to say for sure, but passkeys are certainly a strong alternative to traditional passwords. As more users and businesses recognize the importance and security they offer, adoption is expected to grow. While passwords may not disappear overnight, but the simpler, safer login option that passkeys provide could gradually become the preferred choice for many.

Which One Provides a Simpler Login Experience?

Passwords require you to remember and type them every time you log in to an account. If you forget them, you will have to reset them, which can be tiring at times and can be a pain for users.

Passkeys make logging in much easier and safer. I remember a time when I needed to access my bank account to make a payment, but I was in a crowded place. Typing my password felt risky. What if someone saw it? Additionally, passwords can be lengthy and difficult to type accurately, especially in a hurry. However, my bank app now supports passkeys, so instead of typing a password, I simply use my Face ID to log in. It’s quick and simple, so I don’t worry about anyone stealing my password or watching me type it.

Will Businesses Transition from Passwords to Passkeys?

Passkey is still a growing solution for secure logins. The increase in cyber threats to passwords has prompted many businesses to seek better solutions to enhance security and simplify the login experience. According to Fido, many businesses have already begun adopting passkeys to enhance security while making logins easier and more comfortable for their users.

What Happens If You Lose Your Device With Passkeys?

If you lose your device with passkeys, you can still recover access through cloud synchronization. Most platforms, like Google, Apple, and Microsoft, securely store passkeys in the cloud, allowing you to retrieve them on a new device after signing in with your account credentials and verifying your identity.

If you get a new device, setting up your passkey is simple. Google Chrome support provides step-by-step guidance to help you transfer or restore your passkeys. Since passkeys are stored securely on your device or password manager, you don’t need to remember or type anything. Check out the common questions and answers about Passkeys on Google News.

Conclusion

Passkeys make logins easier and more secure, eliminating the stress of remembering passwords and mitigating security risks. As more companies and websites adopt this technology, users can enjoy faster, safer access to their accounts. Switching to passkeys isn’t just a minor improvement; it’s a significant step toward a safer login, where security is stronger and logins are stress-free.

API security aims to protect APIs from attacks and data breaches.

When we use software applications, such as mobile apps, we take it for granted that the information we request will be delivered quickly and clearly. Before this can happen, however, a vital process must occur: the app connects to the internet and sends data to a server, which retrieves that data, interprets it, performs the necessary actions, and sends us what we have requested – all of which happens via an Application Programming Interface (API).

This ability to serve as an intermediary between two software applications so they can exchange data seamlessly means APIs are fundamental to digital transformation in today’s app-driven business world: they enable mobile experiences, connect companies on the web, and facilitate platform business models.

More than 83% of enterprises use APIs to increase ROI on their digital assets. However, they have become victims of their success. Their ubiquity (coupled with their ability to enable access to sensitive software functions and data) has made them a primary target for cyberattacks.

According to a 2024 API security impact survey of 1,200 CIOs, CISOs, and security professionals, 84% of respondents experienced an API security incident over the past 12 months.– This brings API vulnerabilities and the security best practices needed to mitigate them into sharp focus for businesses.

 Common API security vulnerabilities

Let’s explore five of the most common API vulnerabilities that can lead to network breaches, compromised data, and financial loss for businesses, and provide some tips to help prevent them:

Broken user authentication

This occurs when the user’s session ID or credentials have been compromised due to weak API authentication protocols, allowing attackers to take over their accounts, steal their data, or engage in fraudulent transactions.

Recent research reveals that 94% of applications were found to have some form of broken access control, with an average incidence rate of 3.81%

• Prevention tip: All authentication endpoints should be protected by strict rate limiting, lockout policies, and weak password checks.

Broken object-level authorisation (BOLA)

This occurs when attackers exploit vulnerable API endpoints by manipulating the ID of objects that are listed in API requests. With no check in place to determine ownership of those objects, attackers can access sensitive information by simply changing the ID in a request.

Recent analysis of prevalent security challenges in live APIs identified Broken Object-Level Authorization (BOLA) and injection attacks as the leading issue (37%).

• Prevention tip: Enforce robust authorization mechanisms and redefine how you generate and manage IDs within your API ecosystem.

Injections

This occurs when attackers inject malicious code or commands into APIs through user input fields, allowing them to exploit vulnerabilities or manipulate data. This technique might be effective when APIs do not properly validate or sanitize user input, or when they do not properly handle external data sources or systems.

• Prevention tip: Validate, sanitize, and/or escape user inputs by performing data validation using a single, trustworthy, and actively maintained library.

Excessive data exposure

This occurs when an application, via an API response, provides too much information to the user, meaning they can’t perform a specific action. This reliance on the client side can expose unfiltered data that an attacker can intercept.

Recent analysis of prevalent security challenges in live APIs identified data exposure as one of the leading issues (34%).

• Prevention tip: Treat every response and data field as a vulnerability. Review the API responses to ensure they contain only legitimate data. 

Lack of rate limiting

This occurs when an API does not limit the number of requests a user or system can make in a given timeframe. This can lead to potential Denial-of-Service (DoS) attacks, where a cybercriminal overwhelms the API with requests, causing it to become unresponsive.

• Prevention tip: Limit how often a client can call the API within a defined timeframe and notify them when the limit is exceeded. 

What is API security?

APIs’ vital role as the backend framework for software systems and services means they are a conduit for sensitive data, including access information like authentication and authorization, attracting unwanted attention from cybercriminals.

API security is the process of protecting these backend frameworks from cyberattacks that attempt to exploit them by gaining unauthorized access to the network to steal sensitive data or disrupt services.

Strategies and tools are deployed to restrict access to authorized users only and protect the data transmitted through the API from being compromised or manipulated.

Top 6 API security best practices

The widespread use of these business-critical software interfaces has meant that their vulnerabilities and the nefarious techniques used to exploit them have expanded the cyber-attack surface. 

To mitigate this threat and secure their future revenue and growth, businesses must ensure API requests are authenticated, authorized, validated, cleansed, and resilient when the service is under load. This requires developing and implementing a robust API security strategy built on a foundation of the following best practices.

1. Authentication 

The first layer of defense against unauthorized access to API resources should be a robust authentication system – using standards such as OAuth 2.0, OpenID Connect, and JSON web tokens – that requires users to provide specific login credentials before gaining access to data. 

This process of thoroughly authenticating all related users and devices typically requires client-side applications to include a token in the API call, allowing the service to validate the client. 

2. Encryption

Encrypt all network traffic – notably API requests and responses, as they likely contain sensitive data. These communications between APIs and clients should be secured through an SSL connection or TLS encryption protocol like HTTPS.

For maximum security, use the latest and most secure version of HTTPS with TLS 1.3 protocol enabled for all software applications. This will ensure that all data sent between them is encrypted and shielded from malicious third parties.

3. Access control

Introduce and test controls to manage the level of third-party access to internal data and systems through APIs. This requires a “never trust, always verify” mindset that’s underpinned by three questions: Who? What? When? Known as a zero-trust, this authorization strategy controls data access, creation, update, and deletion.

To reinforce access control, APIs should also be maintained behind a firewall, web application firewall, or API gateway, and accessed via a secure protocol, to provide standard protection, such as scanning for injection-based attacks.

4. Only share the necessary information

API responses typically include an entire data record rather than just the relevant fields.

If the client application fails to filter this sensitive data before it’s made publicly available, it not only slows response times; it also provides attackers with additional information about the API and the resources it accesses, such as keys, passwords, and other personal information necessary to fulfill a request. For example, if a customer’s age is requested, their date of birth shouldn’t be provided in addition.

5. Record APIs in a registry

You can only secure what you know. To make this possible, record all APIs in a registry to define key characteristics such as name, purpose, and live date. By recording pertinent information, you will be well-placed to meet compliance and audit requirements and assist in forensic analysis during a security incident.

The registry should include all technical API requirements, such as functions, classes, and integration processes.

6. Assess risks

Conduct a comprehensive risk assessment for APIs in your existing registry that identifies all systems and data that will be impacted if an API is compromised. Use this insight to outline a treatment plan that contains the controls needed to trim risks to an acceptable level. This will empower you to implement measures that ensure compliance with security policies and protection against known vulnerabilities.

To maintain robust security, document review dates and conduct periodic assessments, particularly in response to new threats or API modifications. Thoroughly review this documentation before making subsequent code changes to guarantee the preservation of security and adherence to data-handling requirements.

7. Monitoring

By continually monitoring your APIs, you can see what users are accessing and what they’re doing with that information. Be vigilant by recording every API request and maintaining audit logs of user activity. Robust governance will provide the agility needed to troubleshoot in case of an error and ensure you maintain data security and compliance.

Create and implement a comprehensive auditing and logging policy regularly reviewed and updated to keep up with pervasive cybersecurity threats.

Conclusion

As the backbone of modern applications, APIs create enriching opportunities for businesses to elevate services, engage customers, increase productivity, and maximize profits – but only if they’re secure. To achieve this, API security must be a systematic process that considers every weak point cybercriminals might target and an ongoing process that keeps pace with the dynamic cyber threat landscape.

Connect with our client-side security experts to know more about it and how to use Jscrambler solutions to protect your client-side assets.

There has been a significant shift towards software development, where organizations ranging from small business entities to large-scale businesses use open-source components to achieve shorter development times and minimized expenses. Based on more recent research, the proportion of open-source code within more recent applications has increased. It is said to constitute between 70-90 percent of many of the commercial applications currently in circulation.

This general usage has led to the development of a tremendous ecosystem that allows developers to build elaborate applications using pre-existing subroutines and initiating modes known as frameworks and libraries. However, this relationship ties organizations heavily to open-source software, posing massive security threats that require vigilant handling. The XZ Utils incident, Log4Shell vulnerability, and the SolarWinds supply chain attack show that existing open-source security protocols must be more potent and more effective.

What is Open Source Security?

Open-source security is the processes, technologies, and measures applied to safeguard open-source software programs and systems. It spans the security process of open source, from component choice to inclusion and validation of code components and even up to component updates and patches for vulnerabilities. At its core, open-source security involves several key aspects:

• Component Integrity: Validating that open-source components have not been tampered with and are downloaded from a proper source. This encompasses confirmation of package origin and ensuring its integrity throughout the software supply chain.

• Vulnerability Management: Ongoing detection, tracking, and remediation of security issues in open-source libraries. This monitors other vulnerabilities, rates their effects, and applies updates or patches when due.

• Compliance and Licensing: Cooperating between open source compliance management and security requirements, including the license requirements and implications of security measures and documentation of all components used.

• Security Assessment: Code review, security testing, and vulnerability scanning of open sources are performed periodically as often as security audits are done. The idea is that threats can be detected before they become threats and used as an opportunity to be secured.

• Ongoing Maintenance: Securing open source components and sub-dependencies during their usage path, updating, monitoring the Security Advisories for any changes, and handling the end-of-life of any deprecated component.

The Risks of Open Source Security

Of all the issues concerning open source, security is one that most users shy away from due to the various risks involved.

Due to its intrinsic characteristics, open-source software is uncontrolled because it is accessible for anyone to employ, alter, and disseminate. This is good for creating new compelling solutions and cooperative working, but it poses risks at the same time. The OWASP Top 10 Risks for Open Source Software provides a comprehensive view of the most critical security challenges organizations face when integrating open-source components:

1. Known Vulnerabilities: This situation focuses on the particular security risks associated with open-source elements when these flaws have been located but not rectified. These vulnerabilities are even more likely to be exploited because the information is available to anyone interested. Once a vulnerability is publicly disclosed and posted on sites like the National Vulnerability Database (NVD), new threats can easily create attacks that will affect organizations that have yet to patch their components.

2. Compromise of Legitimate Package: This takes place when the attacker compromises the package repos or a developer’s ID and posts malicious code into genuine packages. The above compromises are rather sharp and dangerous because they act based on the confidence that organizations bear for classic open-source depots and maintainers. The SolarWinds experience revealed how compromised packages can impact hundreds to thousands of organizations in one supply chain attack.

3. Name Confusion Attacks: They are also referred to as typosquatting or dependency confusion attacks, which occur when attackers develop packages with names close to real packages. Phishers use phenotypic similarities to typosquatting or similar names of packages to convince developers to install spoof packages instead of the intended ones. A lot of the hosts of these attacks exploit the automated nature of dependency management systems that are used nowadays.

4. Unmaintained Software: Free code components that are not maintained pose a huge risk to data security. If maintainers ignore a project or do not respond to security incidents, the project has unprotected security holes and no way to ensure safety. The utilizing organizations thereby become automatically held responsible for maintaining security themselves or accept the increasing risk of running out-of-date code.

5. Outdated Software: As it turns out, even when newer and safer versions of open-source components have been released, organizations do not upgrade to them. This produces security risks since older versions might have recorded susceptibilities or no security enhancements. To prevent errors that cause failure or inability to perform specific functions, updating the dependencies requires a lot of time, exposing clients to other risks for a long time.

6. Untracked Dependencies: It is usually difficult for organizations to know which open-source components they rely on, let alone the downstream dependencies or second-order dependencies. Ultimately, organizations cannot know what components are on their system or whether those components have security problems or require updates. Untracked dependencies make security monitoring and risk management invisible areas that security personnel cannot even see.

7. License Risk: While mainly a legal issue, a license violation can have points related to security measures. Some licenses may require code disclosure or hamper modification ability, thus hindering an organization’s capacity to fuse security fixes. Comprehension and administration of license terms lie at the heart of compliance, security, and flexibility.

8. Immature Software: New or experimental components of an open-source system may not be as secure as they may be if subjected to rigorous real-life use. These components might have numerous unknown, open, or even security anti-patterns that the more mature software has improved over the course of years of development and security auditing.

9. Unapproved Change: Open source components can be upgraded, patched, or modified to contain new features, bug fixes, and security vulnerabilities, but if not approved for inclusion, they can cause security issues when integrated into an application or system. That is why it can be lethal if such an alteration is performed by an unauthorized individual or an individual who has not followed the appropriate checklist, which needs to be solved to ensure that new changes do not bring new vulnerabilities or compatibility problems in the system.

10. Under/Oversized Dependency: Introducing dependencies whose size is too big, including too much code and possible threats, or too small, which cannot perform its functions without adding more dependencies. Unnecessarily large dependencies increase the size of an attack surface in a given application. In contrast, small dependencies may lead to issues such as creating many dependencies in an application, thus complicating security.

Best Practices for Securing Open Source Software

To reduce the threat that has been associated with open-source security, developers and organizations must take the necessary precautions. Here are some best practices:

1. Implement Software Composition Analysis (SCA)

Use appropriate automated tools to constantly monitor and identify open-source software, components, versions, and any known vulnerabilities. This gives certain insights into your software supply chain and allows you to focus on fixing a priority area for an attack. SCA tools need to be best incorporated as part of the development process so that apparent vulnerabilities can be recognized before incorporation into a system.

2. Establish a Vulnerability Management Program

Establish a routine process for addressing security alerts and databases that provide sufficient information and references on security risks. The program should contain procedures for evaluating the effects of the discovered vulnerabilities, selecting the updates by their risk level, and applying them. This is so because the program requires periodic reviews and updates to remain effective throughout its life cycle.

3. Create a Software Bill of Materials (SBOM)

Document all the open-source components across the software and ensure they’re continually updated. This should comprise name, direct and transitive dependencies, version, license, vulnerability, and update records. As a result, the SBOM is the definitive resource for reference during security and compliance purposes.

4. Verify Source Authenticity

Ensure proper authorization of each of the open-source component options. This comprises utilizing package signing and validation features, checking the checksums of downloaded components, and reporting the reliability of the package source and contributors. The level of transparency is then maintained by conducting general audits of the sources from which you acquire your components.

5. Automated Security Testing

Ensure you incorporate or include security testing into your continuous integration and delivery process to discover the weaknesses at the development stage. This should include static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Interactive Application Security Testing (IAST) as a combination of SAST and DAST.

Secure Your Source Software with Jscrambler

Open-source code protection is most commonly done through software like Jscrambler’s, which protects JavaScript apps. To offer extensive security against code modification, reverse engineering, and other forms of attack methods, Jscrambler is a perfect match for safety-conscious organizations.

Here’s how Jscrambler can help with open-source security:

1. Code Obfuscation: The open-source components are safeguarded against further modification and reverse engineering by Jscrambler’s sophisticated methods of JavaScript Obfuscation and code hardening capabilities. This assists in minimizing risks generally associated with supply chain nuisances and the incorporation of malicious codes. The protection system in the platform guarantees that your code is protected when you manage to distribute it in hostile areas.
   
   

2. Real-Time Application Self-Protection (RASP): The platform’s runtime protection assists in recognizing and stopping anti-tampering attempts in real-time so that a compromised open-source component cannot run within your application context. This covers issues related to vulnerable parts, supply chain attacks, installation/run of malicious code, and unlawful alterations. Runtime protection offers extra layers of protection that cannot be procured by simply scanning the code. 
   
   

3. Integration with CI/CD Pipelines: Incorporating Jscrambler with CI/CD means that security remains inherent soon after the code comes to life in the development cycle. Maintaining an organization’s components’ current status and security by examining JavaScript dependencies. That’s why the platform allows teams to monitor vulnerable dependencies, give notifications on security threats, estimate the potential damage of vulnerabilities, prioritize updates based on risk level, and adhere to security standards. Concurrent monitoring is supposed to help identify security threats as early as possible.
   
   

4. Protection Against Supply Chain Attacks: The platform provides end-to-end security solutions for your software supply chain. These include identifying the origins of open source packages, identifying injections of invalid code, analyzing activity in dependents, record keeping for security compliance purposes, and access control measures. 

Overall, open sources add a lot of advantages, but it is very important to mention that we are facing new threats concerning personal security. Using some of the best practices for protection and appropriate tools, open-source software can continue to be used as a safe base for innovation.

From the damage caused by lockdowns to the erosion of consumer spending power amid spiraling inflation, the entertainment and media industry has faced considerable headwinds in recent years. Having weathered the storm, industry revenues rose 5% in 2023 to hit $2.8 trillion and could pass $3 trillion by 2028. However, when it comes to protecting the data that underpins it from breaches by hackers, resilience is often lacking, exposing organizations to disruption, reputational damage, and financial penalties.

These data breaches could be compared to life-imitating art due to their resemblance to blockbuster movies about the murky world of hacking. It’s up to organizations in this space to consign successful cyber-attacks to the big screen by recognizing the importance of data to the industry and taking proactive measures to safeguard it.

Data breaches in Entertainment and Media

Personal data: a core asset of the industry

From unlocking access to online services to providing deep insights into audience preferences, data is a core asset of the entertainment and media industry.

Powering the shift online

The entertainment and media industry has undergone a digital transformation amid a shift online that was proliferated by pandemic-induced lockdowns. This is underscored by the rapid rise of streaming services, which have transformed how content is produced, distributed, and consumed.

These services allow consumers to view a vast array of content from the comfort of their homes or on the move via smart devices. To access this convenience, they must set up accounts and enter sensitive personal data on streaming sites, including credit card details and emails.

It’s a similar story in the online gaming sphere, which has gained attention for the scale of its global revenue. In 2022, the global gaming industry generated an estimated $184.4 billion, compared to the global recorded music and movie industries, which generated around $26 billion each, respectively—an eyewatering amount that depends on consumers providing personal data online to sign up for and purchase gaming services.

Leveraging user data to provide a better service

Content is the lifeblood of the entertainment and media industry. Creating engaging material requires access to consumer data that enables companies to understand and cater to audience preferences, optimize content strategies, and drive personalized experiences. Nowhere is this more prevalent than in the streaming world, where popular platforms like Netflix and Spotify harness user data to provide them with a better service and improve marketing.

This process involves different layers of data collection that include third parties:

• The platform collects first-party data directly from its users, including names, email addresses, account details, and subscription plans.
• Second-party user data, such as demographic and geographic data, is collected and exchanged by partners.
• Third-party data, including behavioral data, is gathered by specific data providers, for example, for marketing purposes.

Data breaches

The entertainment and media industry’s ever-increasing dependence on the internet is expanding its attack surface exponentially, making it an attractive target for cybercriminals. In their sights is the ocean of personal data that’s exposed by weak cybersecurity controls – an all-too-common scenario that has led to several notable data breaches.

Disney

A massive data breach at entertainment behemoth Disney in July 2024 occurred when hackers gained access to public and private Slack channels within the company – exposing over 4 million Slack messages, 18,800 spreadsheets, and 13,000 PDFs – and leaked compromised data. In addition to financial company data that could be used to hold it to ransom, the leak contained personally identifiable information of Disney employees and customers – including passport numbers, visa details, and contact information.

Nintendo

In April 2020, Nintendo was the target of a data breach in which 300,000 customer accounts were compromised. The data exposed in the breach included credit card information, email addresses, geographic locations, names, and Nintendo Network ID usernames.

Hackers targeted the Nintendo Network ID (NNID) system, which lacked two-factor authentication, using methods like phishing. Having gained unauthorized access to personal information and saved payment details, some users experienced fraudulent transactions on their accounts.

CAM4

In March 2020, the Cam4 data breach was reported as the largest data leakage in history. Over 10 billion data records were exposed by the adult streaming site due to a misconfigured Elasticsearch database – an internal search engine used by employees to scan user and activity logs. This left data vulnerable to anyone with an IP address, including first and last names, payment logs, email addresses, and password hashes.

Intellectual property: holding the industry to ransom

The entertainment and media industry is powered by creativity. From scripts to the screen, this takes the form of intellectual property (IP) – the ownership of any creation of the mind or ideas or designs by a person, including screenplays, scripts, films, songs, compositions, sound recordings, TV shows, video games, and animations.

In the wrong hands, IP can be leveraged for financial gain by demanding a ransom from the owner to prevent it from being released or sold. Sometimes it’s all bravado due to the high profile of the hacked data. Before they can make their fraudulent demands or claim bragging rights in hacking circles, cybercriminals must compromise the data – something they’ve become adept at, as demonstrated by the Rockstar Games hack in 2022.

Rockstar Games

In September 2022, a hacker harnessed social engineering techniques to compromise an employee’s login credentials at Rockstar Games. They used this information to breach the Rockstar Games network and access the source code for Grand Theft Auto 5 and the in-development version of Grand Theft Auto 6. The hacker then posted on GTAForums claiming they wanted to “negotiate a deal” with Rockstar Games for the return of the unreleased data.

Impact of data breaches on the industry

The entertainment and media industry’s reliance on digital platforms, IP, and consumer trust means data breaches can significantly impact organizations – operationally, financially, and reputationally.

• Operational disruption

Data breaches resulting in ransom demands for compromised IP can cripple production schedules, disrupt broadcasting, or delay releases. Moreover, third-party risk can indirectly disrupt operations if sensitive data held by a vendor or partner is compromised.

• Financial loss

Data breaches can cause significant financial losses resulting from ransom payments linked to leaked IP, legal and regulatory penalties under laws like the GDPR, the cost of remediation, and lost revenue due to the disruption of business operations.

• Reputational damage

Consumers may hesitate to engage with a streaming platform or purchase content from a company that has failed to safeguard their personal data. High-profile breaches can tarnish a company’s reputation, eroding audience loyalty and damaging brand image.

Preventing data breaches

To shield themselves from data breaches, organizations in the entertainment and media industry must adopt a multi-faceted approach to cybersecurity that combines three key strategies: robust access controls, employee training, and adherence to best practices.

Access controls

Robust access controls protect sensitive data by regulating who can access it – and in what circumstance. Common controls include:

• MFA

Multi-factor authentication (MFA) offers an extra layer of security when accessing systems and applications. In addition to providing their password, users must enter additional information, such as a code sent to their phone or a biometric scan, to log into an account.

• Data encryption

Data encryption builds trust with users by demonstrating a commitment to maintaining the confidentiality and integrity of submitted data. It harnesses robust encryption algorithms, public and private keys, and a trusted certificate infrastructure.

Employee training

Employees should be empowered to recognize and respond to potential cybersecurity threats resulting from data breaches. This requires training on identifying phishing emails, promptly reporting suspicious activity or potential vulnerabilities, and responding in the event of a cyber-attack.

Adherence to best practices

Data handling policies, procedures, and tools provide the structure needed to adhere to best practices. They must be transparent and implemented throughout the organization to ensure everyone understands the correct data management practices – from collection, use, and processing to transfer, disposal, and sharing.

Data Instilling resilience in the industry

From financial gain to malice and bravado, the motivation to compromise data created and held by the entertainment and media industry is multi-faceted amid its ever-widening attack surface and high profile. Whether targeting personal user data to commit fraudulent activities or highly valued IP to demonstrate their hacking prowess, the industry offers rich pickings for cybercriminals.

This perfect storm of motivation and opportunity for these bad actors to compromise industry data amplifies the need for robust access controls, focused employee training, and adherence to best practices. By adopting a comprehensive approach to cybersecurity, organizations within the industry can instill the resilience needed to safeguard the data that underpins it.

Money has migrated from the physical to the digital. It’s moved from bank branches and brick-and-mortar stores to online banking and E-Commerce. Criminals have migrated, too, meaning digital heists have replaced real-world hold-ups.

In the modern economy, data equals money. Worryingly, that makes almost every business, regardless of size, turnover, or industry sector, a target for digital skimming – and digital skimmers.

Every business holds data about customers, staff, or partners. Think: customer lists, payroll data and supplier bank details. Sensitive card data (card numbers, expiry date,s and 3-digit security codes) is definitely where data equals money. No wonder card fraud is a $48 billion a year problem, set to double to $100 billion by 2027.

With cybercrime and cybercriminals showing no sign of let up. And two new PCI DSS requirements around payment pages coming into force from 1 April 2025. We look at how businesses can detect and defend against the scourge of digital skimming and stay safe online.

• What is Digital Skimming?
• How Much of a Problem is Digital Skimming?
• What is the Business Impact of Digital Skimming?
• How Does Digital Skimming Work?
• Which Businesses Are the Main Targets For Digital Skimming
• How Do Magecart Attacks Relate to Digital Skimming?
• How Did Digital Skimming Get So Big?
• How Do Businesses Protect Against Digital Skimming Attacks?
• What Are the Digital Skimming Requirements in PCI DSS v4
• How Does Jscrambler Identify the Presence of Digital Skimming?

What is Digital Skimming?

Digital skimming attacks involve stealing sensitive data inputted by users into web forms. Frequently this is payment data from online checkout pages, although it also includes personally identifiable information, or PII for short, from other web forms.

Digital skimming goes by many names, including e-skimming, data skimming, and formjacking. Then there are the more specific terms of JavaScript attacks or Magecart attacks, which hint at how digital skimmers works.

In summary, the modus operandi of a digital skimming attack is similar. Criminals exploit vulnerabilities in a website’s code or infrastructure to harvest data. Digital skimming attacks are hard to detect as the payment process is unaffected. The customer gets their goods or service and the merchant gets paid. Both parties are unaware that a compromise may have occurred.

How Much of a Problem is Digital Skimming?

Digital skimming is a big, bad problem. Big in terms of the size of the problem. And bad in terms of the likelihood and impact to organizations and end-customers or users.

Some of the biggest, worst data breaches in 2024 include telecoms giant AT&T which confirmed in July 2024 that criminals had unlawfully accessed “nearly all” of its customers’ call and text message data for a 6-month period in 2022. This impacts not only around 110 million customers but also those they interact with.

A June 2024 cyberattack on UK pathology lab Synnovis, a blood and tissue testing lab for hospitals and health services, saw the theft of data related to 300 million patient interactions. It disrupted patient service in London for weeks, leading to thousands of operations being postponed and the National Health Service declared a critical incident.

Elsewhere, around 165 companies were believed to be impacted when cloud storage company Snowflake was hacked. And 560 million Ticketmaster customers had their personal data stolen by cybercriminals, who threatened to publish this on the dark web. Digital skimming attacks show no signs of letup.

What is the Business Impact of Digital Skimming?

The full costs of a data breach to a business could be massive. These include the direct costs of lost revenue, incident response, fines, and breach notification.

For example, US health insurance firm Kaiser disclosed a data breach after online tracking technologies led to the private health information of 13.4 million patients being shared with tech companies and advertisers. The US Postal Service also fell foul of using tracking pixels on its website, potentially exposing the details of 62 million users.

There are the indirect costs associated with a digital skimming attack, namely the loss of brand value, reputation, and trust. Prescriptions provider MediSecure learned this the hard way when it declared insolvency just weeks after confirming it was the victim of a ransomware data breach, affecting nearly 13 million people in Australia.

How Does Digital Skimming Work?

In general, there are four stages in a digital skimming attack:

1. Initial breach

Criminals gain access to the source code of the server of an online store either as a first-party attack or by compromising a third party. Often this is by exploiting software vulnerabilities, deploying malware, or using stolen (or phished) credentials.

2. Code injection

Criminals inject malicious code to compromise payment pages. They evolve their methods. And tailor them depending on whether payment forms appear directly on pages or are embedded using an iFrame.

JavaScript attacks, as the name suggests, target the programming language used by more than 98% of websites to create interactive pages.

3. Data exfiltration

The harvesting of data occurs when consumers enter their payment details to complete their purchases on compromised payment pages. Or enter personal data on online forms. The malicious code covertly skims and collects the information, often encrypting it, before sending it to the attacker’s remote server.

4. Monetization

Criminals monetize stolen data by using it to make unauthorized, fraudulent purchases for goods to re-sell for cash. Or by selling the data to other criminals.

 

Which Businesses Are the Main Targets for Digital Skimming

In short, every business is a target. Sadly, criminals aren’t choosy about the size or nature of your business. Whether you’re large, small, or anywhere in between. Whether you’re a retailer, non-profit organization, charity, educational institution or government agency makes no difference to criminals.

Nor are they choosy about the nature of your customers. They could be consumers, other businesses, large corporations, multinationals, or even government departments.

Card data is card data. PII (personally identifiable information) is PII. Criminals want it to sell on underground forums. Or to monetize it themselves by creating fake identities or fake cards to commit crimes.

The most common type of data stolen or compromised in 2024 was customer PII at 48%, according to IBM Security’s Cost of Data Breach Report 2024. However, the most lucrative PII to steal was employee PII, including tax ID numbers, e-mail and home addresses, because it can be used in so many more ways.

Generally, if data has value to you or your customers. Then, you can almost guarantee it has value to criminals, so protect it.

How Do Magecart Attacks Relate to Digital Skimming?

Magecart attacks are named after ‘Magento’, the primary open-source e-commerce platform, and shopping ‘cart’. Magecart also refers to the criminal group active since 2015 carrying out such attacks.

In a Magecart attack, criminals inject the digital skimmer through malicious JavaScript code. This actively monitors the payment page and steals sensitive card data whenever a user enters it into a form. This is then sent to servers controlled by the attackers.

Magecart attacks typically attack the payment pages of e-commerce websites either as a first-party attack or a third-party attack.

• First-party attack – criminals access the victim’s website and directly place the digital skimmer on the payment page. Examples include the 2023 attack on DNA testing company 23andMe which leaked nearly 7 million user records and the October 2024 attack on the internet archive Wayback Machine.

• Third-party attack – criminals inject malicious code via a third-party provider that the victim organization is using. Also known as a supply chain attack, it is particularly pernicious as modern websites rely on 13 different pieces of third-party code on average, but up to 35, to run functionality on web pages. Each of these could present attackers with a way-in.

Nearly every respondent to a recent Jscrambler survey (97%) said they knew third-party tags collected sensitive or private data. Half (49%) admitted that these tags had collected data there weren’t supposed to in the last 12 months. And 26% that sensitive data had been leaked to another organization.

How Did Digital Skimming Get So Big?

The Internet was designed for sharing and collaboration not necessarily banking, shopping, and telemedicine.

How web applications are built has also changed over time. The business intelligence has moved from web servers, owned and managed by companies, into the consumer web browser, powered by JavaScript, distributed APIs, and microservices.

As a result, any JavaScript running on a web page can access all data entered into form fields on that page. With no separation between different parts of the application, this makes data susceptible to attack.

How Do Businesses Protect Against Digital Skimming Attacks?

The first step in keeping your customers’ data and business safe is understanding the threats out there. Specifically, digital skimming and web app attacks, malware and unauthorized access.

Next, put in place controls to prevent unauthorized access to sensitive data. Don’t underestimate the importance and effectiveness of business-as-usual security. That’s installing and maintaining firewalls, strong password and unique logins for each person with computer access. But also technologies like encryption, tokenization and anti-virus.

Also, conduct regular security assessments, monitoring and third-party due diligence, plus deploy secure code and adhere to payment security standards (PCI DSS).

What Are the Digital Skimming Requirements in PCI DSS v4

Given the ubiquity and innate security vulnerabilities of JavaScript on payment pages, the PCI Security Standard Council (PCI SSC) published an updated version PCI Data Security Standard (PCI DSS) in March 2022.

Version 4.0 of the PCI DSS contains two new requirements to protect against and detect digital skimming attacks on payment pages. These will be requirements from 01 April 2025.

• Requirement 6.4.3 – the first new PCI requirement is designed to minimize the attack surface and manage all JavaScript present in the payment page.

• Requirement 11.6.1 – the second new PCI requirement aims to detect tampering or unauthorized changes to the payment page and generate an alert when changes are detected.

Jscrambler’s free PCI DSS 4.0 compliance tool helps businesses that accept card payments achieve frictionless compliance with requirements 6.4.3 and 11.6.1 of PCD DSS v4.0, plus helps PCI Qualified Security Assessors (QSAs) to validate compliance.

How Does Jscrambler Identify the Presence of Digital Skimming?

Jscrambler addresses both new PCI requirements (prevention and detection) concerning attacks on payment pages.

What’s more, as the payment page is likely to include other JavaScript libraries, Jscrambler provides a smoother and easier way to manage the integrity of third-party code, compared to Content Security Policy (CSP) and Subresource Integrity (SRI).

 

Features include:

1. First-party code hardening and obfuscation

Obfuscation and protection of the first-party code that the payment service providers supply to merchants, further enhance the defense against tampering with payment pages.

2. Webpage inventory

Complete visibility of every script and network request on your website. Simplifies the identification of malicious client-side behavior and vetting of resources.

3. Third-party management

Simple onboarding and vetting of third-party scripts, with full observability of each script and a powerful rules engine that can be used to control its behavior.

4. User data management

Dashboard with details of how user data is being handled on the client-side, with insights into possible data leakage.

5. Webpage threat mitigation

Powerful and granular rules engine that blocks any script in real-time, if it exhibits malicious or prohibited behavior (e.g. digital skimming, DOM tampering and data leakage).

Prevent Digital Skimming with Jscrambler

Feel free to connect with our client-side security experts to try our solutions to prevent digital skimming attacks.

JavaScript plays a vital role in creating dynamic and interactive user experiences. However, the increasing reliance on third-party libraries and packages has introduced a new concern: supply chain security. In this article, we take a deep dive into the JavaScript supply chain security concept and explore its potential risks and vulnerabilities.

Supply chain security refers to the measures taken to protect software and its components from being compromised during the development and deployment process. As JavaScript frameworks and libraries are often fetched from various sources, they become potential entry points for malicious attacks on a website or web application.

By understanding the risks and vulnerabilities associated with JavaScript supply chain security, developers and cybersecurity professionals can implement effective strategies to mitigate these threats. From vetting and verifying the integrity of dependencies to utilizing content security policies, several steps can be taken to enhance the security of a JavaScript supply chain.

The Importance of Supply Chain Security in the Context of JavaScript

In recent years, supply chain security has gained prominence as attacks targeting software supply chains have increased in frequency and sophistication. For JavaScript developers, understanding the intricacies of supply chain security is crucial. A single vulnerability in a dependency can compromise the entire application, leading to data breaches, loss of user trust, and significant financial damage.

Moreover, the dynamic nature of the JavaScript ecosystem, where packages are constantly updated and new dependencies are frequently added, makes maintaining security an ongoing challenge. Developers must be vigilant about the libraries they use, the permissions they grant, and the updates they apply, ensuring that security is not compromised at any stage of the development process.

Common Vulnerabilities and Threats in the JavaScript Supply Chain

JavaScript supply chain vulnerabilities can arise from various sources, including compromised packages, malicious code injections, and outdated libraries. The risks of the JavaScript supply chain are as follows:

1. Malicious Packages: One of the primary risks in the JavaScript supply chain is the introduction of malicious packages. Attackers can publish packages with malicious code to repositories like npm, which developers can then unwittingly include in projects.

2. Dependency Confusion: This occurs when a public package with the same name as an internal package is introduced. If the public package has a higher version number, package managers may resolve to use the public package, leading to potential security breaches.

3. Typosquatting: Attackers create packages with names similar to popular libraries, hoping that developers will mistype the package name and inadvertently install the malicious version.

4. Supply Chain Attacks: Attackers target the build and distribution infrastructure of popular packages, injecting malicious code into legitimate updates.

5. Outdated and Vulnerable Dependencies: Using outdated libraries with known vulnerabilities can expose applications to attacks.

Impact of JavaScript Supply Chain Attacks

Data Breaches and Unauthorized Access: 

When attackers inject malicious code into JavaScript libraries, they can gain unauthorized access to sensitive information, such as user data and login credentials. This can result in data breaches and the potential misuse of the stolen information.

Distributed Denial of Service (DDoS) Attacks: 

Compromised JavaScript libraries can execute DDoS attacks, employing unsuspecting users’ devices as part of a botnet. This can overload targeted websites or services, leading to significant disruptions and financial losses for the affected organizations.

Practices for Securing the JavaScript Supply Chain

• Securing the JavaScript supply chain requires a multifaceted approach. Developers should practice due diligence when selecting libraries and frameworks. This includes researching the reputation of the package, examining its security history, and reviewing its maintenance practices.

• Regularly updating dependencies is also critical to ensure vulnerabilities are patched. However, updates should be applied carefully, with each new version vetted to ensure it does not introduce new risks. Automated tools can help track dependencies and alert developers to vulnerabilities, but manual review is still essential for high-risk components.

• Also, adopting a “least privilege” approach to dependency permissions can limit the impact of a compromised package. By restricting the actions a dependency can perform, developers can reduce the potential damage of an attack.

• Incorporating security checks into the continuous integration/continuous deployment (CI/CD) pipeline can further enhance supply chain security. Tools like Snyk, npm audit, and GitHub’s Dependabot can automatically identify vulnerabilities and suggest or apply fixes, integrating security into the development workflow.

Tools and Technologies for Enhancing JavaScript Supply Chain Security

Several tools and technologies are available to help developers secure their JavaScript supply chains. Dependency management tools like npm and Yarn offer built-in features for identifying and resolving vulnerable packages. Security-focused platforms like Snyk provide comprehensive vulnerability scanning and monitoring for JavaScript projects, offering actionable insights and automated fixes.

Developers can use software composition analysis (SCA) tools for more granular control over package integrity. These tools analyze the composition of an application’s dependencies, identifying potential security, licensing, and quality issues. By incorporating SCA tools into the development process, teams can proactively manage supply chain risks.

Content Security Policies (CSP) are another powerful technology for mitigating the impact of supply chain attacks. By specifying which sources are trusted, CSPs can prevent the execution of malicious scripts, even if they are introduced through a compromised dependency.

Conclusion

JavaScript supply chain security is a critical aspect of modern web development. With the increasing complexity of applications and reliance on third-party packages, adopting best practices and staying vigilant against potential threats is essential.

Understanding and addressing JavaScript supply chain security is not just a technical necessity but a fundamental responsibility for developers and organizations committed to maintaining the integrity and trustworthiness of their software.

Anecdotal evidence that JavaScript is the top programming language is easy to come by. Ask most web developers and they will wax lyrical about its versatility, ease of use, and dynamism. This high praise is emphasized by a recent survey showing the majority of developers (62.3%) identified it as the language they want to work with for a tenth straight year – an enduring popularity underpinned by its ability to keep pace with the rapid evolution of web development. However, with widespread adoption and progression comes an increased risk of JavaScript security vulnerabilities.

JavaScript provides threat actors with an irresistible combination of ubiquity and a widening attack surface: most websites (98%) use it client-side to create interactive web pages, while the exciting trends and advancements perpetuating this adoption are susceptible to attacks.

Amid this perfect cyber-attack storm, threat actors are developing new and more advanced techniques to exploit JavaScript’s weak points – a worrying trend is showing no signs of abating in 2025. Let’s investigate the top JavaScript vulnerabilities to look out for in the coming months and how to combat them.

JavaScript Vulnerabilities to Look Out for in 2025

1. Cross-Site Scripting Attacks (XSS)

XSS attacks occur when malicious third-party scripts are injected into trusted websites. Once deployed, threat actors can harness them to exploit vulnerabilities that enable the execution of malicious JavaScript code in another user’s browser – leading to data theft, account compromise, or even full system control through further exploitation.

One of the most common JavaScript threats, XSS attacks are constantly being tweaked by perpetrators to maintain their deleterious impact and avoid detection. For instance, as JavaScript frameworks like React, Vue, and Angular evolve in 2025, threat actors will refine XSS attacks that target these blueprints for building web applications.

Prevention tips: Ensure client-side user input is validated and sanitized before being included in HTML output. Additionally, encode any user-generated content before displaying it on web pages to prevent the browser from interpreting it as executable code or clickable web links.

2. E-skimming

This client-side attack occurs when threat actors inject malicious code onto a website to compromise sensitive data – including credit card numbers, expiration dates, and security codes – inputted by users into payment processing pages and other online forms.

Unauthorized access to the site is typically gained by compromising assets originating from outside its security perimeter, such as client-side web assets – the files and resources downloaded and executed by the user’s web browser when they visit the site. 

To achieve this, threat actors typically target JavaScript vulnerabilities by injecting the malicious skimming code via a supply chain attack or a direct hack of a website. The code infiltrates the site’s point of sale, allowing sensitive data to be compromised. These attacks can go unnoticed for weeks or months because they occur beyond the boundaries of traditional security controls, creating a blind spot that allows the malicious code to hide in plain sight.

Prevention tips: Audit and monitor JavaScript code, especially third-party script. Implement Subresource Integrity (SRI) to ensure the scripts loaded on the website are not tampered with by validating their integrity. Regular updates and patches to the website platform and any third-party plugins will prevent vulnerabilities in outdated versions from being exploited. 

3. Supply chain attacks

Supply chain attacks target third-party libraries, packages, or dependencies that developers use to provide web functionality – including JavaScript libraries containing pre-written scripts that streamline web development. Once compromised, attackers can inject malicious code into all websites using that third-party resource.

Once the code has been added to a website’s software by targeting JavaScript vulnerabilities, it surreptitiously spreads when users install updates from what they assume is a trusted source – exposing the data of an ever-expanding number of unsuspecting victims. 

Prevention tips: Adopt a multi-layered approach to mitigating supply chain attacks that includes the implementation of web application firewalls (WAFs), a robust Content Security Policy (CSP), and Subresource Integrity (SRI). Augment this by verifying partners’ controls and certifications, performing third-party risk assessments, and mapping the flow of traffic and critical data.

4. Formjacking

Formjacking occurs when attackers inject malicious JavaScript code directly into a website’s payment page or login forms, hijacking their functionalities. The script intercepts the input fields, typically targeting payment card information and other sensitive data entered by users, and sends it to the attacker’s server.

This type of attack exploits the trust users have in established, legitimate web applications. Consequently, a formjack can remain undetected for a prolonged period as the form behaves normally.

Prevention tips: Regularly patch and update the website’s software, plugins, and extensions, use a secure connection to safeguard data during transmission, and regularly scan the site and server logs for vulnerabilities and suspicious activities.

5. Prototype pollution

All objects in JavaScript contain a prototype that they inherit properties and methods from. This prototype chain allows objects to share common behavior. When an object property is accessed, JavaScript looks for it on the object itself. If it doesn’t exist there, it searches further up the chain.

Prototype pollution happens when a threat actor injects arbitrary properties into an object’s prototype to modify it and change the behavior of all objects it creates. Having gained unauthorized control of properties in a web application, they can launch attacks from within. For instance, having exploited the client-side JavaScript, the attacker might execute a DOM XSS – a cross-site scripting vulnerability that occurs when a web application’s client-side JavaScript modifies the Document Object Model (DOM) to create harm.
 

Prevention tips: Stop untrusted user inputs from directly modifying object properties by validating and sanitizing inputs, especially when merging or copying objects. Avoid using functions that automatically merge object properties. Instead, use libraries and functions that offer safe deep cloning and merging. Block potentially dangerous keys, like proto, constructor, and prototype, from being set or modified. 

6. Insecure Direct Object References (IDOR)

Client-side IDOR attacks occur when an application exposes sensitive objects to users without proper access controls that validate whether they have authorization to view them. The vulnerability stems from the application trusting data or object references manipulated directly in the client-side code. Because the code typically interacts with sensitive data, JavaScript logic can be easily viewed and exploited by threat actors using this technique.

Prevention tips: Implement robust access controls that validate all requests on both the client side and the server. This comprehensive approach will ensure the user is authorized to access or modify the requested resource. Introduce role-based access controls that restrict access to resources based on the user’s role and permissions. Avoid embedding sensitive information in client-side code, including JavaScript, as this helps threat actors discover potential IDOR vulnerabilities.

Conclusion 

JavaScript is a double-edged sword: on one side, it has compelling benefits, such as its versatility and ease of use, that make it the go-to web programming language; on the other, it has innate security vulnerabilities stemming from its widespread use, client-side execution, and dynamic nature.

While the rewards of using JavaScript provide the building blocks for the web, threat actors leverage the risks it poses by wielding the other, more threatening, side of the sword. To blunt the sharp rise in increasingly sophisticated attacks targeting JavaScript vulnerabilities, you must adopt secure coding practices and employ robust defense mechanisms that reinforce your web applications in 2025 – and beyond!

With the rising popularity of React Native, the need for robust security grows equally urgent. Traditional security practices are essential, but are they enough? Advanced techniques like code obfuscation, white-box cryptography, and MAST platforms offer additional protection. Whether you’re a seasoned developer or just starting, this guide empowers you to secure your React Native apps and ensure user data protection.

The Importance of Application Security in Today’s Digital Landscape

In today’s interconnected world, where sensitive information is increasingly stored and accessed through applications, application security has become more crucial than ever. As the reliance on digital services grows, so does the potential impact of security breaches and attacks.

Reasons why application security is critical in today’s digital landscape:

1. Protection of Sensitive Data

2. Maintaining Business Continuity

3. Ensuring User Trust and Confidence

4. Compliance with Regulations

5. Protection of Critical Infrastructure

Common Security Vulnerabilities in React Native Applications

Injection attacks (SQL injection, cross-site scripting) 

Injection attacks are a serious threat to web applications, allowing attackers to inject malicious code into a website and potentially gain unauthorized access to sensitive information, disrupt website functionality, or even take control of the server.

There are two main types of injection attacks:

• SQL injection (SQLi): injects malicious SQL code into website input fields, such as login forms or search bars, allowing attackers to manipulate the database and steal data or grant themselves access.

• Cross-site scripting (XSS) injects malicious scripts into website content, such as comments or user profiles, allowing attackers to steal user information, execute unwanted actions on their behalf, or redirect them to phishing websites.

Injection attacks can have severe consequences, including data theft, website defacement, loss of control, and denial of service. They can expose sensitive information, disrupt your website’s functionality, and even allow attackers to take control of your system.

Insecure data storage and handling 

Insecure data storage and handling refers to the practice of storing sensitive information without adequate safeguards in place. This can leave your data vulnerable to unauthorized access, theft, and misuse. Insecure data storage and handling pose a significant risk of data breaches, identity theft, financial loss, and reputational damage. Hackers can steal your data, exposing your personal information and leading to financial losses. This can severely damage your company’s reputation and erode customer trust.

Weak authentication and authorization mechanisms 

Weak authentication and authorization mechanisms are major vulnerabilities that can leave your systems and data exposed to unauthorized access, manipulation, and theft. These weaknesses can provide attackers with a foothold in your environment, allowing them to escalate their privileges, steal sensitive information, and disrupt critical operations.

Types of weak authentication and authorization mechanisms

• Weak passwords: easy-to-guess passwords or password reuse across multiple accounts.

• Lack of multi-factor authentication (MFA): Reliance solely on passwords for authentication.

• Unencrypted credentials: storing passwords in plain text or using weak encryption methods.

• Insecure access controls: granting excessive permissions to users or allowing unauthorized access to resources.

• Missing authorization checks: failing to verify user permissions before allowing access to sensitive data or functionality.

• Improper session management: not invalidating sessions or using weak session tokens.

Insecure network communication (lack of HTTPS, insufficient encryption) 

Insecure network communication leaves your data vulnerable to interception and manipulation as it travels between devices. This lack of security can lead to various attacks, compromising your data and privacy. Insecure network communication occurs when:

• Data is transmitted without encryption, which means anyone can eavesdrop on the communication and steal sensitive information, such as passwords, credit card numbers, and personal information.

• Weak encryption protocols are used: Even if encryption is used, older or weak encryption protocols can be easily cracked by hackers.

• Websites are not using HTTPS: This means the communication between your browser and the website is not encrypted, leaving it vulnerable to eavesdropping.

• Unsecured Wi-Fi networks are used: Public Wi-Fi networks are often not secure, making it easy for hackers to intercept data transmitted over these networks.

Third-party library vulnerabilities

Third-party libraries are essential building blocks for modern software development, offering ready-made functionality and saving developers time and effort. However, these libraries can also introduce hidden vulnerabilities that put your software at risk. These libraries can be used in various ways, such as adding features and functionality, saving development time, and promoting code reuse.

Third-party libraries are not always perfect. They may contain security vulnerabilities that could allow attackers to gain access to your systems, steal your data, or disrupt your operations.

Best Practices for Securing React Native Applications

Secure coding practices are paramount. By incorporating these practices into your development process, you can significantly reduce the risk of vulnerabilities and security exploits in your applications. Key aspects of secure coding:

1. Input Validation

Never trust user input blindly. Always validate and sanitize all user input before processing it. This helps to prevent attackers from injecting malicious code into your application.

2. Output Encoding

Encode all output before displaying it to the user. This helps to prevent cross-site scripting (XSS) attacks, where attackers can inject malicious scripts into your application and steal user information or redirect them to phishing websites.

3. Use prepared statements

When using SQL queries, always use prepared statements instead of directly embedding SQL code into your application. This helps to prevent SQL injection attacks, where attackers can inject malicious SQL code into your application and steal data from your database.

Utilize secure data storage solutions (e.g., encrypted storage):

Ensuring the confidentiality, integrity, and availability of your data is crucial for maintaining business continuity and protecting sensitive information. Secure data storage solutions play a key role in achieving this objective.

Effective methods for secure data storage:

1. Encryption: unreadable data without a key, preventing unauthorized access. 

2. Data Loss Prevention (DLP): monitors data traffic to identify and prevent leaks of sensitive information. 

3. Access Control: Restricts access to data based on user roles and permissions. 

4. Data Backup and Recovery: Ensures data restoration in case of disasters or breaches, minimizing disruptions. 

5. Cloud Storage: Offers secure and scalable storage solutions for global accessibility. 

6. Hardware Security Modules (HSMs): Dedicated hardware for enhanced security of sensitive data and cryptographic operations. 

7. Tokenization: Replaces sensitive data with non-sensitive tokens for increased protection against breaches. 

8. Data Minimization: Collects and stores only necessary data, reducing breach risk and simplifying data privacy compliance.

These solutions offer varying levels of security and cater to different needs. Choosing the right combination ensures optimal protection for your critical data.

Implement robust authentication and authorization mechanisms (e.g., OAuth2, JWT): 

Robust authentication and authorization mechanisms are essential for protecting your valuable assets and ensuring the security of your applications and systems. These mechanisms ensure that only authorized users can access sensitive information and resources.

Types of robust authentication and authorization mechanisms:

1. OAuth2: Provides secure third-party application access to user data without revealing passwords. Widely used and popular. 

2. JWT: Securely transmits information between parties in a compact, self-contained token. Popular for Single Sign-On (SSO) and API access. 

3. Multi-factor authentication (MFA): Adds an extra layer of security by requiring additional verification factors (fingerprint, token, OTP) beyond username and password. 

4. Single sign-on (SSO): Enables access to multiple applications with one set of credentials, improving user experience and reducing password fatigue. 

5. Role-based access control (RBAC): Grants permission to resources based on users’ organizational roles, ensuring access only to necessary information and resources.

These mechanisms offer varying degrees of security and address different needs. Choosing the right combination ensures optimal user experience and robust access control for your systems.

Encrypt sensitive data in transit (HTTPS, TLS): 

Encrypting sensitive data in transit is a vital security practice that ensures confidentiality and integrity during communication.

Methods for encrypting data in transit:

• HTTPS: This is the secure version of the HTTP protocol and uses Transport Layer Security (TLS) to encrypt communication between a web browser and a web server. All websites should use HTTPS to protect user data.

• TLS (formerly known as SSL): This is a cryptographic protocol that provides secure communication between two applications. TLS is used to secure various communications, including email, messaging apps, and file transfers.

• VPNs: Virtual private networks create a secure tunnel over a public network, encrypting all data traffic between the user and the VPN server. VPNs are particularly useful for protecting data on public Wi-Fi networks.

Validate user inputs and sanitize data: 

Malicious actors can inject harmful code or manipulate data through user input, leading to serious security threats like data breaches, SQL injection attacks, and cross-site scripting (XSS).

Techniques for user input validation and data sanitization:

• Input masking: Restricts the types of characters that users can input.

• Regular expressions: Used to match specific patterns in user input.

• Whitelisting: Allows only specific values for user input.

• Blacklisting: Blocks specific characters or sequences that are considered harmful.

• HTML entity encoding: Converts special characters into their HTML entity equivalents, preventing them from being interpreted as code.

• URL encoding: Encodes special characters in URLs to prevent them from being interpreted as part of the URL path.

Regularly audit and update third-party libraries: 

Regularly auditing and updating third-party libraries is a crucial security practice that helps mitigate these risks and protect your software from cyberattacks.

How to audit and update third-party libraries:

• Use a Software Composition Analysis (SCA) tool: SCA tools can help you identify all the libraries used in your codebase, their versions, and any known vulnerabilities.

• Review security advisories: Regularly check for security advisories issued by library developers and update libraries as needed to address vulnerabilities.

• Utilize automated update tools: Several tools can automate the process of updating libraries, saving you time and effort.

• Prioritize critical libraries: Focus on updating libraries that are used extensively or have known vulnerabilities.

• Test updates: Before deploying library updates to production, test them thoroughly to ensure they do not introduce any regressions or compatibility issues.

Implement a secure development lifecycle (SDLC):

The Secure Development Lifecycle (SDLC) is a structured approach to integrating security into every stage of the software development process. By incorporating security practices throughout the process, organizations can significantly reduce the risk of vulnerabilities and build more secure software applications.

SDLC phases and security considerations

1. Planning and Requirements:

• Identify security requirements

• Conduct threat modeling

• Select secure libraries and frameworks

2. Design and Architecture:

• Implement secure design principles

• Use secure coding practices

• Perform static code analysis

3. Implementation and Development:

• Implement secure coding techniques

• Use secure APIs and libraries

• Perform unit and integration testing

4. Testing and Deployment:

• Perform penetration testing

• Security configuration review

• Vulnerability scanning

5. Monitoring and Maintenance:

• Monitor security logs and alerts

• Perform regular security audits and assessments.

• Update software regularly

Tools and Techniques for Securing React Native Applications

Linting and static analysis tools 

Linting and static analysis tools are essential allies in the software development process. They help developers identify potential issues with their code early on, leading to more robust and reliable applications. Linting tools examine the source code and identify pre-defined coding rules and conventions violations. This can include syntax errors, e.g., missing semicolons; style violations, e.g., inconsistent indentation; and potential problems, e.g., unused variables.

Static analysis is a broader category of tools that goes beyond linting. They perform a deeper code analysis, looking for potential logical errors, security vulnerabilities, and performance issues. This can include:

• Dead code

• Unreachable code

• Security vulnerabilities

• Performance bottlenecks

Popular linting and static analysis tools:

• Linting: ESLint, JSLint, Pylint, Flake8, Rubocop

• Static analysis: SonarQube, Fortify, Coverity, FindBugs, and CodeQL

The best linting and static analysis tool for your project will depend on the programming language you are using, your team’s preferences, and the specific needs of your project.

Penetration testing and vulnerability scanning 

Cyber threats are constantly evolving, so proactive security measures are crucial. Penetration testing and vulnerability scanning are two essential tools that help organizations identify and address security weaknesses before attackers can exploit them.

Penetration testing:

Penetration testing simulates a real-world attack on your systems and applications. Ethical hackers, also known as penetration testers, attempt to exploit vulnerabilities in your defenses to gain unauthorized access to your data and systems. This provides valuable insights into your security posture and helps you identify and fix vulnerabilities before attackers can find them.

Vulnerability scanning:

Vulnerability scanning uses automated tools to identify known vulnerabilities in your systems and applications. These tools compare your software to databases of known vulnerabilities and identify matches. While not as comprehensive as penetration testing, vulnerability scanning can provide a quick and efficient way to identify common weaknesses.

While penetration testing and vulnerability scanning offer valuable benefits, they are most effective when used together. Vulnerability scanning provides a broad overview of potential weaknesses, while penetration testing provides a deeper understanding of how these weaknesses can be exploited.

Code obfuscation and white-box cryptography and white-box cryptography are two techniques used to protect software from unauthorized access and modification. While they share some similarities, they have distinct purposes and approaches.

Code obfuscation is the process of transforming code into a form that is difficult to understand and analyze but still retains its original functionality. This makes it harder for attackers to reverse engineer the code and steal intellectual property, exploit vulnerabilities, or inject malicious code.

Common code obfuscation techniques:

• Control flow obfuscation: Modifying the code’s execution flow to make it harder to follow.

• Data obfuscation: encoding data to make it unreadable without the decryption key.

• String encryption: encrypting strings to hide sensitive information.

• Symbol renaming: renaming variables and functions to make them less meaningful.

• Dead code insertion: Adding unnecessary code to confuse attackers.

White-box cryptography is a cryptographic technique where the encryption key is embedded within the software itself. This allows the software to perform cryptographic operations without needing to store the key in a separate location, which can be vulnerable to attack.

The best approach for your software depends on your specific needs and security requirements. Code obfuscation is a good option for protecting intellectual property and preventing tampering, while white-box cryptography is a good option for protecting sensitive data and enabling secure execution in untrusted environments.

Mobile application security testing (MAST) platforms 

MAST platforms are specialized tools designed to analyze and test mobile applications for security vulnerabilities. They offer a range of features, including static code analysis, dynamic analysis, fuzzing, penetration testing, and vulnerability management. Popular MAST platforms are Appknox, Checkmarx SAST, esChecker, NowSecure Platform, Synopsys, Data Theorem Mobile Secure, and AppScan. 

The best MAST platform for your needs will depend on your budget, the type of mobile applications you develop, and your security requirements. Some factors to consider include:

• The features offered by the platform.

• The ease of use of the platform.

• The platform’s integration with your existing development tools.

• The cost of the platform.

Application firewalls and intrusion detection systems (IDS)

In the landscape of cybersecurity, safeguarding applications from malicious attacks is crucial. Two essential tools in this fight are application firewalls (WAFs) and intrusion detection systems (IDS). While they have overlapping functionality, they offer distinct approaches to security.

Application Firewalls (WAFs):

Application firewalls act as gatekeepers, controlling and filtering traffic to and from web applications. They analyze incoming traffic based on pre-defined rules and block any requests that are deemed malicious or suspicious. This helps prevent attacks like SQL injection, cross-site scripting, and denial-of-service (DoS) attacks.

Types of WAFs:

• Network-based WAFs: deployed at the network level, inspecting traffic flowing between the internet and the application.

• Host-based WAFs: installed directly on the web server, offering granular control over application-specific traffic.

• Cloud-based WAFs: offered as a service, providing scalability and centralized management.

Intrusion Detection Systems (IDS):

Intrusion detection systems monitor network traffic and application activity for signs of suspicious or malicious behavior. They analyze packets, logs, and other data to identify potential attacks, notifying administrators and taking automated actions if necessary.

Types of IDS:

• Network-based IDS (NIDS): monitors traffic flowing through the network, detecting threats across various applications.

• Host-based IDS (HIDS): installed on individual systems, focusing on detecting attacks targeting specific applications or operating systems.

• Wireless IDS (WIDS): monitors wireless networks for suspicious activities.

WAFs and IDS play crucial roles in securing applications; they offer complementary functionality. Using them together provides a layered defense against various threats. WAFs act as a first line of defense, filtering out known attack patterns, while IDS provide deeper analysis and detection of more sophisticated attacks. By prioritizing security and embracing advanced techniques, React Native developers can build secure, trustworthy, and future-proof applications.

As the hospitality industry recovers from the challenges posed by the COVID-19 pandemic, global tourism has mostly returned to pre-pandemic levels, with many high-income regions seeing robust travel and hotel demand. This has forced hotel chains, restaurants, travel, and entertainment to adjust to shifting travel patterns including the resurgence of leisure travel and more seasonal demand which has complicated staffing and scheduling.

While the industry had already adopted digital tools during the pandemic to maintain safety, efficiency, and customer engagement, they continued their investment in digital platforms for improved revenue management, as data-driven tools enabled businesses to monitor changes to customer behavior and demand fluctuations to adjust pricing, staffing, and resource strategies accordingly.

To support this digital transformation hospitality became more reliant on third-party services, from booking platforms to marketing and analytics tools. While these services bring undeniable benefits, they also come with hidden dangers, particularly in the form of third-party tags.

Third-party services, such as online booking engines, chatbots, customer review tools, and digital marketing solutions, have become essential to the modern website. These tools offer the ability to streamline operations, enhance customer experience, and provide valuable customer insights. However, this doesn’t come without risks.

The essentials of using third-party tags

In the hospitality industry, global companies like Marriott, Wyndham, Hilton, Intercontinental, Hyatt, Melia Hotels, Radisson, MGM, and Caesars use these third-party services to understand customer behavior, facilitate bookings, and help manage customer relationships. A hotel website might include a third-party booking system for their accommodations and social media share buttons. A restaurant chain usually features a third-party reservation form and review gatherer on its website. A travel agency adds a third-party tag to handle their car hire services online on their page and accept payments. These are just a few examples.

The benefits of using third-party tags such as the ones listed above are numerous: increased customer visibility, improved customer engagement, and the ability to offer personalized experiences. Third-party services can also help businesses manage reviews, run targeted advertising campaigns, and analyze customer behavior to optimize product and service offerings.

What data is being collected on the client side?

Third-party scripts enable the collection of extensive client-side data, often unknown to the end user. These scripts can track a variety of information, including:

• User behavior: Information on how users interact with a website, including pages visited, time spent on each page, and actions taken (e.g., clicks, form submissions).
• Demographic information: Data such as age, gender, location, and language preferences, which can be used to tailor marketing efforts.
• Device and browser information: Details about the device and browser visitors use, which can inform website optimization efforts (including IP address).
• Purchase history: Records of user transactions, including items purchased, the amount spent, payment methods used, and payment data.

The dangers of third-party tags in the hospitality industry

While the collection of such data can offer numerous benefits, it also presents significant risks that businesses in the hospitality industry need to be aware of:

Analytics & Personalization Tags

Analytics and personalization tags include Google Analytics, Adobe Analytics, Hotjar, LogRocket, and Fullstory which are used to track user interactions on websites and apps. They help hotels understand customer preferences, booking patterns, and website navigation behavior, allowing for a personalized guest experience. Some of the above also replay sessions to identify and analyze drop-off points, but in the process collect sensitive user information which comes at a risk. For instance, by recording and replaying a payment session, these third-party tags may inadvertently record and store payment card data outside the Cardholder Data Environment (CDE), placing it in a non-PCI DSS-compliant environment. Additionally, other tags could collect credit card information beyond their intended scope or outside of PCI DSS compliance, raising security and regulatory concerns.

Marketing & Retargeting Tags

Marketing and retargeting tags from ad networks including Facebook Pixel, Google Ads, and TikTok, are commonly used to gather metrics and support marketing efforts, particularly for retargeting campaigns. These allow hospitality brands to reach out to guests who have previously interacted with their site but didn’t complete a booking, providing targeted offers and reminders. They’re also designed to collect an extensive set of guest data, including sensitive credit cards, rewards, check-in/check-out dates, passports, credentials, and booking reference information. This raises questions about what data is being accessed or shared by third-party tags, since to effectively retarget users, marketing tags will attempt to capture all data available on a page to identify the user. Therefore, it is crucial to establish clear policies on what data should be collected and ensure the protection of user privacy.

Customer Support & Chatbot Tags

Example support and chatbot scripts include LiveChat and Zendesk enabling customer service automation, allowing guests to receive assistance 24×7. AI-driven chatbots also use tags to record interactions to improve future interactions. To be effective chatbots must collect as much guest information as possible, which is often sensitive, and quite often outside of the intended form field. Hospitality companies must ensure these third-party tags are only allowing access to the forms and data necessary to support the support interaction.

Know Your Customer (KYC) Tags

Example KYC solution providers include Jumio, Onfido, Trulioo, Authenteq, and Persona. KYC tags become important for luxury hotels, resorts, and rental properties where verifying identity is important. They’re also used for payment security, regulatory compliance, and guest personalization and loyalty. However, there are potential risks associated with this use. To complete the authentication process, some tags may collect sensitive information, such as passport numbers, driver’s license numbers, and photos. Proper safeguards are necessary to ensure that only the required data is collected and securely handled to protect user privacy.

Booking & Payment Processing Tags

Examples of booking engines (like Sabre and Amadeus) and payment gateways (like Stripe and PayPal) as well as buy now pay later (BNPL) services like Afterpay and Klarna, ensure guests have seamless, secure booking and payment experiences including the ability to support real-time pricing adjustments.  However, these third-party tags are vulnerable to tampering by other scripts, which may manipulate the payment process or introduce malicious changes to the page. This poses significant risks, including the potential for attackers to steal user credentials or disrupt the payment flow, emphasizing the need for robust security measures to protect transaction integrity. In addition, all hospitality companies that process credit card transactions must comply with PCI DSS.  Effective March 31, 2025 merchants must comply with new requirements 6.4.3 and 11.6.1. These new requirements intend to protect merchants including hospitality from digital skimming attacks, a continued and growing threat to hospitality websites.

Tag Managers

Google Tag Manager and Adobe Launch are tag management systems (TMS) that offer a convenient way to embed tags on a website without needing direct involvement from the development team. These applications allow non-technical teams, such as marketing, digital, or the business, to add scripts independently, which can be resource-efficient and straightforward. However, this ease of access can introduce security risks, as scripts may be added without adhering to the company’s security policies, potentially exposing the site to third-party data risks.

Mitigating third-party tag risks

To mitigate the risks mentioned above, businesses in the hospitality industry must take a proactive approach that balances security with customer-centricity. Here is some guidance:

• Audit third-party tags regularly: Regularly review and audit third-party scripts in use to ensure they are necessary, secure, and compliant with current policies.
• Implement strong data management: Establish clear policies outlining how data is accessed, collected, used, and protected. Ensure that third-party services adhere to these policies.
• Educate hospitality guests: Be transparent with guests about data collection practices. Clearly explain what data is being collected, and how it is used, and give them control over their data.
• Opt for privacy-focused third-party tag solutions: Consider using third-party services that prioritize privacy and security while enabling businesses to run and innovate. Opt for services that are transparent about their data practices and are compliant with standards and regulations.

Comprehensive control with security and compliance expertise

The hospitality industry’s reliance on third-party online services is a double-edged sword. While these services offer essential capabilities to improve guest experiences, manage revenue, and coordinate resource demand in a post-pandemic world, they also introduce data privacy, security, and customer trust risks. By understanding the potential dangers and taking steps to mitigate them, businesses can harness the benefits of third-party scripts while protecting themselves and their customers from harm.

The crucial question becomes…How can hospitality providers effectively protect guest data while continuing to innovate?

When evaluating security solutions to meet these needs, every hospitality provider should consider a client-side protection solution based on the following criteria:

1. Comprehensive platform

• First-party data encryption and protection

The platform should enable state-of-the-art data protection for all guest information collected throughout the customer journey, from reservation to checkout.

• Fine-grained control over third-party vendors

The platform should offer consistent, fine-grained visibility and control over the behavior and data usage of all third-party services and software integrated into the hospitality ecosystem.

2. Flexible hybrid deployment 

Given how a hospitality provider may have a lot of domains, login pages, and payment pages that collect personal data, it is essential to choose a provider that has flexible deployment options with a convenient dashboard that aggregates data in one place.

With the PCI DSS v4 compliance deadline approaching, it is worth checking whether a potential compliance provider can help you quickly bring many payment pages into compliance with a deployment option that doesn’t require configuration. That can significantly make your life easier and remove the need to get approval from various stakeholders or allocate additional team resources to manage the new solution.

3. Peak season performance

 

The platform selected must also be capable of scaling up to support the largest and most demanding operations without causing any slowdown or disruption to the guest experience, particularly during peak seasons like holidays or large events.

Given the hospitality industry’s seasonal fluctuations, it’s crucial that the solution can scale up or down based on operational needs.

4. Comprehensive data security and compliance policies

 

A key feature should also be its ability to support the development of a centralized security policy by all involved teams (e.g., operations, IT, guest services, marketing, governance, risk, and compliance). This policy should encompass all client-side risks and regulatory compliance requirements, such as PCI DSS v4 compliance. It should offer assessment-ready reports for Qualified Security Assessors (QSAs).

5. Client-side & PCI DSS expertise

 

Client-side protection and compliance vendors should possess years of expertise in protecting JavaScript, with deep knowledge in guiding organizations through PCI DSS compliance. For third-party services, skilled consultants should be available to assist in setting up the best risk mitigation strategies, including data access controls. A fully managed service should also be an option if desired. A vendor with the right level of expertise will empower business operations while fostering customer trust.

In conclusion, it can be said that by adopting a proactive approach to security, hospitality companies can strengthen their defenses against evolving threats, ensuring a safer, more secure, and trusted guest experience.

The third-party tags, or the vast majority of them, serve a purpose and support the business, and thus cannot be removed. Nor should they be. By monitoring them and understanding the job of each tag or script, businesses can better control them and keep their digital platforms safe for their customers.

This is where Jscrambler can help, with a client-side protection and compliance platform that mitigates third-party tag risks while ensuring compliance with the new anti-skimming requirements in PCI DSS v4. With Jscrambler, businesses not only adopt a unified, fine-grained client-side security approach but also gain access to the top PCI DSS experts in the industry that accelerates compliance ahead of the impending March 31, 2025 deadline. Book a demo to see Jscrambler’s solution in action today.