Comparison
Attack surfacevsThird-party script
Attack surface
the feature added one endpoint, and that endpoint took a file path from the client.
Everything an untrusted party can reach and influence — endpoints, parameters, file uploads, dependencies, admin tools, the CI system. It grows quietly with every convenience added, and shrinking it is usually cheaper than defending it. It belongs in ordinary design review, not only security review, because the least defensible surface is the one nobody realised they had added.
Full entry →Third-party script
the page got half a second slower and nobody on the team changed any code that week.
A script loaded from another origin and controlled by someone else: analytics, tag managers, chat widgets, ads. It runs with full access to your page, competes for the main thread and the network, and can change without warning or review. It is very often the largest single item in a performance investigation, and the one nobody has the authority to remove.
Full entry →