Jscrambler

13/10/2026

We're gearing up for the PCI SSC Europe Community Meeting. 💳

Meeting PCI DSS requirements 6.4.3 and 11.6.1 is essential to avoid regulatory penalties and pass regular audits, but checking the compliance box is only the baseline for a modern security strategy.

Treating client-side security purely as an annual assessment milestone leaves critical vulnerabilities open in the ex*****on layer where sensitive data lives.

By moving beyond simple change detection to continuous, real-time client-side governance, organizations protect customer trust, secure intellectual property, and turn compliance requirements into a foundation for comprehensive digital security 👉 https://eu1.hubs.ly/H0z1QXq0

Client-side security tools, agent-based and agentless solutions for PCI 6.4.3 & 11.6.1 compliance, & prevention of digital skimming attacks.

12/10/2026

That’s a wrap on IAPP Privacy. Security. Risk. + AI Governance Global 2026! 👋

We had a great time in Seattle connecting with privacy, security, and data governance leaders.

Thank you to everyone who stopped by to meet with the Jscrambler team and shared their perspectives on privacy, security, compliance, and the evolving risks of AI.

A special thanks to Sean O'Leary, Bryan Powell, Tyson Whitten, Nathan Coppinger, and Gareth Bowker for representing Jscrambler in Seattle.

Until next time! 👋

05/10/2026

Happy Monday! ⛅

Make sure to subscribe to our monthly newsletter to receive all the latest news on Jscrambler's initiatives and products. We bring you the latest on client-side protection, PCI DSS v4.0 compliance, and JavaScript-related tutorials. 📰

Subscribe now at https://eu1.hubs.ly/H0yHnr00

Jscrambler is the leader in client-side protection. Subscribe to our newsletter to receive all the latest news on Jscrambler's initiatives and products.

29/09/2026

Your SBOM shows what you built. Your vendor questionnaire shows what they promised.

Neither shows what third-party scripts are doing in your customers' browsers right now. ⬇️

That's the gap Magecart-style attacks exploit: a vetted vendor script gets compromised upstream, and no build-time scan or assessment catches it.

Our latest post explains why supply chain security stops one step too early, and how to extend it to runtime. Read it now at Jscrambler's blog https://eu1.hubs.ly/H0yHP5y0 📘

Software supply chain security and third-party risk have a starting line. They have no finish line, but programs are built as if they do.

25/09/2026

At IAPP Privacy. Security. Risk. + AI Governance Global 2026, we’ll be talking about the growing gap between privacy policies and what actually happens in the browser at runtime.

Pixels firing before consent, third-party scripts expanding their data collection, and AI agents accessing data they shouldn’t - these are runtime problems that a CMP alone can’t fully address. ⤵️

Join Jscrambler in Seattle on October 8–9 to learn how runtime enforcement can help close this gap and protect data where it matters: in the browser. 💻

You can meet the team at the event: Sean O'Leary, Bryan Powell, Tyson Whitten, Nathan Coppinger, Gareth Bowker 👥

📍 Seattle Convention Center
🗓️ October 8–9, 2026

Planning to attend? Let’s connect at https://eu1.hubs.ly/H0yCwCR0 🔗

**A

Join us at IAPP 2026, where the global media, entertainment, and technology community comes together to shape the industry's future.

22/09/2026

C**A litigation is shifting, not disappearing ⬇️

If passed, California SB 690 will curb pen register lawsuits, but §631 wiretapping claims against tracking pixels, chatbots, and session replays remain an active risk.

For organizations operating websites with visitors in California, that means website tracking and third-party scripts are still under scrutiny.

And a CMP alone isn’t enough.

A CMP records consent. Runtime enforcement helps ensure it’s actually enforced in the browser.

Our latest blog by Nathan Coppinger breaks down 5 steps to help reduce C**A litigation risk - including why organizations need to move beyond passive consent management to active browser runtime enforcement.

👉 Read it now at Jscrambler's blog https://eu1.hubs.ly/H0ywVZL0 📘

**A

C**A is being weaponized by plaintiffs’ attorneys against modern website technologies like tracking pixels, session replays, and chatbots.

18/09/2026

🔜 Heading to GRRCon 2026 - next week!

📍 DeVos Place Convention Center, Grand Rapids
📅 September 24–25

AI is accelerating development-and with it, client-side risk. Come meet the Jscrambler team to learn how we’re helping organizations secure AI-generated code, govern third-party scripts, and protect sensitive data in the browser.

👋 Come by and meet Nathan Coppinger and Ray Bozic!

Let’s talk about securing the browser runtime in the age of AI. Schedule a meeting at https://eu1.hubs.ly/H0yrHpb0 🔗

Join us at GrrCON 2026 in Grand Rapids. Meet our team and discuss the latest cybersecurity challenges, threats, and application security strategies.

17/09/2026

SAQ A compliance doesn't mean your checkout is safe.

A prime example: a Magecart campaign abused Google Tag Manager and Stripe's own API to skim payment data, storing payloads in metadata and exfiltrating data right back through Stripe's legitimate channels. Because the infrastructure was trusted, teams were completely blind to the abuse. ⤵️

The problem: when PCI DSS updated SAQ A guidance, many merchants overlooked the Eligibility Criteria (EC) entirely. Assuming SAQ A gives a free pass, they quietly dropped script inventories and tamper detection instead of enforcing client-side governance.

The reality: if a script runs in your customer's browser, whether it's an ad pixel or a payment tool, you own the data risk. Data leakage doesn't stop at checkout.

In our latest blog post, we dive into:

🔹 Why skipping the SAQ A Eligibility Criteria is riskier than it looks
🔹 How attackers and over-collecting marketing pixels exploit trusted platforms
🔹 Why client-side security must extend beyond payment pages and checkbox compliance

Read the full breakdown on the Jscrambler blog: https://eu1.hubs.ly/H0ypT120 📘

PCI DSS Gaps: Cyberattacks on e-commerce payments continue to escalate, exposing a flaw in how online retailers manage client-side security.

03/09/2026

🍸 Join Jscrambler at the PCI Pawn Shop Social!

After a full day at the PCI SSC North America Community Meeting, unwind with us in Vancouver for an exclusive evening of networking, great conversations, drinks, and appetizers.

📅 September 15 | 7:30 PM
📍 The Pawn Shop, Vancouver

🎟️ Invitation-only - Pre-register to request your spot at https://eu1.hubs.ly/H0y3QLT0 🔗

t

Meet Jscrambler at the PCI SSC North America Community Meeting Social Event 2026. Set a time to meet with our client-side protection and PCI DSS compliance experts.