Third-party scripts documented

Every external script loaded by your application is a potential supply chain attack vector. Without documentation of which scripts are loaded and why, a security review cannot determine whether a given external dependency is intentional or injected — and developers cannot confidently audit or remove scripts that are no longer needed. CWE-1357 (Reliance on Insufficiently Trustworthy Component) applies when third-party scripts are loaded without recorded justification. OWASP A08 (Software and Data Integrity Failures) calls out undocumented third-party dependencies as a supply chain risk. Documented inventories also accelerate incident response when a CDN is compromised.

Add a third-party script inventory to your README or a dedicated docs/third-party-scripts.md. At minimum, record each script's domain, purpose, and when it was added.

## Third-Party Scripts

| Script | Domain | Purpose | Added |
|--------|---------|---------|-------|
| Google Tag Manager | googletagmanager.com | Analytics | 2024-01 |
| Stripe.js | js.stripe.com | Payment processing | 2024-02 |
| Sentry Browser SDK | browser.sentry-cdn.com | Error tracking | 2024-03 |

Alternatively, add an inline comment above each <script> tag explaining its purpose and owner. The goal is that any developer or security reviewer can quickly answer: is this script supposed to be here, and who approved it?