Real-user monitoring script: an inventory note
A real-user-monitoring vendor runs in the visitor's browser with the access of any script on the page. An inventory note, not a defect.
What it is
Real-user monitoring (RUM) measures how pages perform for actual visitors by running a script in their browsers. It is useful and common. It is also a third-party script with the same access as any other, and a vendor your privacy notice and your security review should name.
What squirrel checks
The rule reports every catalogued vendor tagged as real-user monitoring that a sampled page loads. It is an information-only inventory item.
rum-in-productionreports info once per page and vendor. Message:Inventory note: https://example.com/ loads the real-user-monitoring script from Example RUM.rum-in-productionpasses withNo real-user-monitoring script was seen.otherwise.
Nothing is wrong with a RUM script as such. The check exists so the vendor shows up in the third-party picture, next to the others. Only sampled pages are checked.
How to fix it
Usually nothing. Confirm the vendor is in your privacy notice and vendor register, that the data it collects matches what you disclose, and that you load it on the pages that need it rather than everywhere.
| Rule | third-party/rum-in-production |
| Category | Third-party, part of Security |
| Scope | Site (cloud audits only) |
| Severity | info |
| Weight | 1/10 |
Enable / disable
Cloud audits do not read squirrel.toml, so these rules cannot be switched off there. They run whenever the audit includes the third-party scan, and report as skipped when the scan could not run.