Tag manager on a sensitive page: who can publish code to sign-in and checkout

What it is

A tag manager is a script that loads other scripts, configured in a dashboard rather than in your code. On a sensitive page that makes the dashboard part of the page’s attack surface: anyone with publish rights, or anyone who takes over an account that has them, can run code on your sign-in or checkout without a deploy or a code review.

What squirrel checks

For each sampled sensitive page (a page whose URL path says it is a sign-in, sign-up, checkout, cart, payment, billing, wallet or account page (see how a sensitive page is decided)), the rule looks for a vendor the catalogue tags as a tag manager.

• tag-manager-on-sensitive-page warns once per page and vendor. Message: https://example.com/checkout (checkout page) loads the tag manager Example Tag Manager.
• tag-manager-on-sensitive-page passes with No tag manager loads on a sensitive page. otherwise.

The rule cannot see what the manager publishes, so it flags that the door exists, not that anything bad came through it. Sensitivity comes from the URL path only, and only sampled pages are checked. The issue is rated high only when the same audit also found a vendor on a sensitive page that the catalogue rates as a concern (the rating is internal and never shown).

How to fix it

Serve sign-in and checkout without the tag manager, or use a separate, locked-down container for those pages that carries only what they need. Limit who can publish, require review and two-factor authentication on the account, and keep an audit log of changes.

Rule	third-party/tag-manager-on-sensitive-page
Category	Third-party, part of Security
Scope	Site (cloud audits only)
Severity	warning
Weight	1/10

Enable / disable

Cloud audits do not read squirrel.toml, so these rules cannot be switched off there. They run whenever the audit includes the third-party scan, and report as skipped when the scan could not run.