# Reader brief — prove "no third-party requests" in a browser

**Use this if:** your footer makes a privacy claim, or you are about to put "no trackers" on a page
and want to know whether it is true. **Time:** one hour for the first audit, ten minutes for each
re-run. **You need:** the deployed URL, and a browser automation tool (Playwright or Puppeteer).

This is the method behind *One dependency, one third party, zero trackers*. The finding that matters
is not the tracker — it is that **every source-level check said zero while the rendered page loaded a
third party**. The claim is about the wire, so the test has to watch the wire.

## The prompt

```text
You are verifying that a web page loads nothing from a third party. The claim is a property of the
rendered page and its network requests, NOT of the source code.

INPUTS
- The DEPLOYED URL (not the local server).
- The list of named exceptions, if any (e.g. the payment provider's script on the checkout page
  only). Anything not on the list is a failure.

DO
1. State the property precisely: "every request the page makes is to <own origin>, except <named
   exception> on <named page>". Write down the exception list before testing.
2. Run the probe matrix and record each result:
   - curl with a default UA
   - curl with a browser UA
   - the raw HTTP response body
   - a real browser: rendered DOM (script/img/link/iframe elements)
   - a real browser: every request event and its origin
   - performance.getEntriesByType('resource')
   - console errors
   - cookies and service-worker registrations
3. Report each origin contacted. A single unexpected origin fails the claim.
4. Classify every unexpected element or origin as: absent, present-but-blocked (e.g. by CSP), or
   present-and-executed. Only "absent" makes the claim true; "blocked" is mitigation.
5. Fix at the source (turn the edge feature off) rather than only blocking it. Then re-run the full
   matrix on the deployed host and report zero.
6. If the claim cannot be made unconditionally true, weaken the copy until it is exactly what you can
   verify. Do not publish a claim a skeptic can falsify in ten seconds.

ACCEPTANCE CHECKS
- The rendered DOM contains no unexpected script/img/link/iframe.
- The request log contains no origin outside the own origin and the named exception.
- No console errors from refused third-party loads (after the fix; during mitigation, one refusal is
  the mitigation working and must be classified, not hidden).
- The check is run on the deployed host, because an edge default can add code your repository does
  not contain.
```

## Feed it these files

| File | What it gives you |
|---|---|
| `origin-verification.md` | the probe matrix, the allowed-set rule, and the Playwright snippet |
| `third-party-audit.md` | the full incident: the edge-injected beacon, the CSP mitigation, and the source fix |

## What good looks like

- [ ] `curl` returns zero references — and you do not count that as evidence.
- [ ] The rendered DOM and the request events are the evidence, and they agree.
- [ ] The own-origin/exception list is written down before the test, so the test cannot be fitted to
      the result.
- [ ] An unexpected origin fails the audit with a non-zero exit, and the claim is withdrawn until it
      passes.
- [ ] The fix is at the source; a CSP block is recorded as mitigation, never as "zero".
- [ ] `grep` matching a string in an HTML comment is not treated as an injection — the checks look
      for an element, a resource entry or a request.

## Failure modes this piece paid for

- **`curl` sees nothing, the browser sees the beacon.** Cloudflare injected Web Analytics into real
  browser sessions only. Default UA, Chrome UA, identity/gzip encoding, the local server and the raw
  response body were all zero; the rendered DOM had one. Source-level checks cannot see edge
  injection.
- **A CSP that blocks is not a fix.** The browser still attempted the cross-origin request. The real
  fix was switching the injection off in the dashboard; only then was the claim unconditionally true.
- **A comment that names the thing trips the grep.** After the fix, `grep cloudflareinsights` still
  matched — inside an explanatory HTML comment. A string count is not evidence of an injection.
- **Local passes, production differs.** The beacon existed only on the deployed host. Verify the
  origin.
- **A claim that cannot fail is marketing.** The property, measurement and failure condition are what
  make the claim engineering; the copy has to be weak enough to be true.

## Where to go next in the pack

`origin-verification.md` is the runnable method; `third-party-audit.md` is the full worked incident
including the CSP trade-off. The storefront piece's `verify-origins.mjs` is the same method packaged
as a script if you want a starting point.

One-line test: **open DevTools, watch the network, and try to falsify your own footer.** If you can,
the footer is wrong.