The script inventory PCI asks for is a diff that is usually empty

PCI DSS wants a list of every script that loads on your payment page, and proof you'd notice a new one. Most teams keep a spreadsheet that was accurate in March.

A cron entry runs at 02:10. It tells hoody-browser to load the checkout page, then reads GET /network?browser_id=0&clear=true: every request the page made, with method, URL, status and resource type. A short script keeps the script entries, sorts their hostnames, and writes them to /audit/checkout-scripts.txt.

The file lives in hoody-files, so each nightly write is a journaled revision. ?diff&from_ts= against last night is the whole report. Most nights it's empty. The night a tag manager quietly pulls in a fourth analytics host, the diff is one line.

The inventory isn't a spreadsheet someone maintains. It's a diff that is usually empty.