Marketing wants a new tag manager script on the checkout page. Security objects. Who is right and what do you propose?

What the interviewer is testing

Whether you understand the browser's trust model for third-party scripts and can offer a workable middle position.

Security is right about the risk

A third-party script on the checkout page executes with full page privileges. It can read every form field including card details, modify the DOM, intercept form submissions and exfiltrate data — and it is loaded from a domain you do not control, which can serve different content at any time, to any subset of users.

This is the exact mechanism behind a long series of card-skimming compromises, where the victim's own site was never breached: the compromise was in a third-party script or in the script's own dependencies.

Note the compounding factor: a tag manager can load further arbitrary scripts, so approving one script is approving an open-ended set that changes without any deployment on your side.

The proposal

Do not run third-party scripts on the page that handles payment data. That is the position to hold.

The ways to satisfy marketing without it:

Server-side tagging. Events are sent to your own endpoint and forwarded to the analytics destination server-side. Marketing gets the data; no third-party code runs in the browser. This is now a mature approach and is the answer for most cases.

Payment fields in an isolated iframe hosted by the payment provider, so page scripts cannot access them regardless — which also reduces PCI scope substantially and is worth doing anyway.

A strict Content Security Policy on the checkout page permitting only first-party scripts, plus subresource integrity where a third-party script is unavoidable elsewhere.

Confine the tag manager to non-sensitive pages, with the checkout explicitly excluded.

What a strong answer adds

Framing the trade commercially: the marketing benefit is measurable attribution; the risk is a card-skimming breach with mandatory disclosure, card scheme penalties and PCI consequences. Server-side tagging delivers the first without the second, which turns a confrontation into a solution.

Common weak answers

Approving with a review of the script, which does not bind future content served from that domain. Refusing without offering server-side tagging.