You are liable for every script on your site. Including the ones you did not write.
The TSR Audit (Third-Party Script Risk Audit) analyses the code that actually reaches your visitors – for supply chain risks, end-of-life libraries, known vulnerabilities and policy violations. Results within one to two working days.
--Days
--Hours
--Minutes
--Seconds
-- days until the new EU Product Liability Directive applies: software will then explicitly count as a product.
The risk sits in someone else's code
An average shop page loads scripts from a dozen sources: tag managers, tracking pixels, A/B testing, chat widgets, payment providers, affiliate master tags, CDN libraries. Any of them can change at any time – server-side, without notice, without anyone on your side touching a thing. What is configured in your CMS tells you nothing about what is being delivered today.
Supply chain attacks A hijacked NPM package, a bought-up plugin, a tampered CDN resource: one compromised building block is enough to deliver malicious code to every visitor. In June 2024, polyfill.io did exactly that to more than 100,000 websites. The NPM worm "Shai-Hulud" hit packages with a combined 2.6 billion weekly downloads in September 2025, followed by Axios with over 100 million weekly downloads in March 2026.
End-of-life libraries AngularJS 1.x has received no security updates since 2022 – known vulnerabilities stay open permanently. Shipping end-of-life code falls below the state of the art, and you will not notice, because nothing looks broken.
Outdated versions with known vulnerabilities jQuery: 12 registered CVEs, in use on 84 % of all websites, listed by the US agency CISA in its catalogue of actively exploited vulnerabilities. Lodash: 10 CVEs, the most severe at CVSS 9.1. All publicly documented – including for attackers who search for them deliberately.
Skimmers that look like tracking Magecart groups hide credit card skimmers in CSS files and SVG graphics, or disguise them as Google Tag Manager. In 2025, more than 23 million online transactions were compromised. Invisible to operators and customers alike.
The tag manager blind spot Anyone with GTM access can inject scripts without you seeing it. CSP and CORS protect against injected code – not against approved code that is altered by an update or a compromise.
Violations of Google's spam policies Since 15 June 2026, Google treats manipulative use of the History API as a serious violation. Tracking pixels, A/B tools, advertising libraries and SPA routers can all be affected. Not every access is a violation – but you cannot tell from the minified code of someone else's script.
What is at stake
A single compromised or non-compliant script is enough.
Data breach Credit card and customer data, harvested directly at checkout. Once you become aware, the GDPR Art. 33 notification clock starts: 72 hours.
GDPR fine Up to €10 million or 2 % of global annual turnover for violations of Art. 25 and 32. Up to €20 million or 4 % for violations of the principles in Art. 5.
Product liability From 9 December 2026, software explicitly counts as a product. Inadequate cybersecurity and missing security updates can constitute a product defect.
Visibility Ranking demotion up to complete deindexing from Google Search – and suspension of Google Ads in parallel.
Lost time A reconsideration request with Google can take weeks. So can forensic analysis after a skimmer is found. Your business does not run during that time.
Trust A data incident at checkout is exactly the kind of incident customers tell others about. And the kind that reaches the press.
Stage 1: The TSR Scan One-time analysis, results within one to two working days
Script inventory: We record every script that is actually delivered – per page type (homepage, product page, category page, cart, checkout), because every template loads different scripts.
Vulnerabilities & EOL: We match all open source libraries in use against known vulnerabilities (CVEs), end-of-life versions and abandoned projects – together with OTTRIA.
Supply chain analysis: Where does the code come from, which dependencies does it pull in, and who actually controls the infrastructure that delivers it to your visitors.
Indicators of compromise: Scripts from unknown or suspicious domains, hidden and minimally sized iframes, patterns of injected code, and JavaScript redirects.
Policy check: Every History API access is identified, classified and assessed – passive observation (such as Google Tag Manager, Facebook Pixel or Clarity) is distinguished from active manipulation. Plus a check for back button hijacking.
Manual expert review: No automated tool report. Every scan is reviewed by our experts – with a risk assessment and concrete recommendations, and a half-hour results meeting on request.
Separation of roles: We deliver the findings and the recommendation. Implementation stays with you or your agency – we do not change anything in third-party systems, because we neither have nor want access there.
Price: €1,299 for one website with up to five page types. From 5 websites €999, from 10 websites €799 per website. All prices excluding VAT.
Stage 2: TSR Monitoring Because a script that is clean today can be compromised tomorrow
Recurring scans: Automated repetition of the full check at configurable intervals.
Change detection: New, modified or removed scripts since the last scan – including newly added third-party domains that were not there before.
Supply chain monitoring: New CVEs, fresh compromises and abandoned projects in exactly the libraries you use. Analysis in cooperation with OTTRIA.
Alerting: Notification on new violations or a changed risk profile – before Google finds it or an attacker exploits it.
SSL monitoring: Warning about expiring certificates before browser warnings scare your visitors away.
Documentation: Every scan is documented and dated. Exactly what you need to present in an audit or a liability case.
Price: €149 per month for one website, €119 per website from 5, €89 per website from 10. Minimum term 6 months; 5 % discount on a 6-month contract, 10 % on a 12-month contract. All prices excluding VAT.
What is changing legally right now
New EU Product Liability Directive – from 9 December 2026 Directive (EU) 2024/2853 replaces the 1985 product liability regime and must be transposed into national law by 9 December 2026. It explicitly treats software as a product. A product can be defective if it does not provide the cybersecurity that can reasonably be expected, or if necessary security updates are not supplied. Destruction or corruption of data also becomes recoverable damage, and the burden of proof has been eased in favour of claimants. Anyone delivering software to users should be able to demonstrate that they know it and maintain it.
GDPR Art. 25 and Art. 32 Art. 32(1) requires the "state of the art" and ongoing resilience of the systems in use. Art. 25 requires data protection by design – starting with the choice of technical means. Outdated and end-of-life libraries fall below the state of the art by definition.
Mitigation of fines under GDPR Art. 83(2) When setting a fine, supervisory authorities take into account the technical and organisational measures implemented (lit. d). A documented, dated TSR Scan is evidence that the libraries in use are systematically reviewed and monitored – rather than merely good intentions.
For agencies and networks: GDPR Art. 28 Processors must provide "sufficient guarantees" of appropriate technical measures. Anyone deploying or recommending software on behalf of clients settles the question of responsibility with a documented scan. The TSR Audit is also available as a white-label service.
Partnership with OTTRIA We carry out the library and supply chain analysis together with OTTRIA (Open Source Trust, Threat & Risk Intelligence Alliance), the European specialist for open source security analysis and software supply chains. No comparable combination of policy monitoring and supply chain surveillance for websites currently exists in Europe.
Please note The TSR Audit is a technical assessment, not legal advice. We deliver the documented findings – the legal assessment is yours to make with your legal counsel.
You cannot secure what you do not know. Find out within one to two working days which code runs on your site.