---
title: Tip: a monitoring or analytics snippet runs with your users' sessions. Keep third-party scripts off pages that sign transactions or show secrets, and lock them with CSP | ctxsec
url: https://ctxsec.com/items/tip-third-party-scripts-pin-and-isolate-from-sessions
description: ""
status: "guidance (based on the Oct 29 Polymarket/DebugBear incident)"
published: 2026-10-29
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-third-party-scripts-pin-and-isolate-from-sessions.md)

guidance (based on the Oct 29 Polymarket/DebugBear incident)

2026-10-29

### Tip: a monitoring or analytics snippet runs with your users' sessions. Keep third-party scripts off pages that sign transactions or show secrets, and lock them with CSP

The Polymarket drain did not need a bug in Polymarket's code: a script it loaded from a performance-monitoring vendor changed, and it ran with each signed-in user's session. Practical controls: (1) keep a list of every external script origin per app and remove the ones you no longer use; (2) do not load analytics, RUM, chat or A/B tools on pages that authorize payments, trades, wallet actions or show API keys, or load them in a sandboxed iframe; (3) set a Content-Security-Policy `script-src` allowlist and `connect-src` limits so an injected script cannot send data to new hosts; (4) where a vendor serves a fixed file, self-host it or pin it with Subresource Integrity (`integrity=`); (5) alert when a third-party script's hash changes.

Sources: [DebugBear on X: impacted by an ongoing security incident; RUM customers should remove the embed code (Oct 29, 18:00 UTC)](https://x.com/DebugBear/status/2115866496643535293) · [Hudson Rock / InfoStealers: wallet-draining code found in a third-party script (Oct 29)](https://www.infostealers.com/article/polymarket-breach-alert-wallet-draining-code-found-in-a-third-party-script/) · [MDN: Subresource Integrity](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity)