The only client-side security company with a proxy solution. Gain visibility into every 3rd party script, attack, fraud attempt, and AI agent on the client-side

Joined March 2024
84 Photos and videos
May 13
David Attenborough turned 100 and you still don’t know how your app behaves in a browser.
1
163
Mar 4
Observing a surge in client-side fetches happening to msclairty[.]com hijacking referral tokens. Still unclear of the extension responsible but judging by the volume it must be top one of the 5000 browser extensions.
1
1
651
25 Jul 2025
🚨 Magecart Alert 🚨 A live Magecart skimmer on payment pages is exfiltrating credit card data in violation of PCI DSS. Script downloaded from: hxxps://meriksshadowfiend[.]top/moritz-ca/metrics.js Sending stolen data to: hxxps://pixelnotinggo[.]top/api/accept-metrics
1
4
3,784
24 Jul 2025
Multiple shipped features this month 🤩 Full details on cside. dev/changelog.
4
943
22 Jul 2025
A browser extension can quietly remove critical security headers like CSP. No warning. No consent. You install an extension and suddenly, protections against data leaks and injections are gone. Should we make this an explicit opt-in? Or will that see no adoption?
3
495
21 Jul 2025
❗️We've identified a Magecart-like attack on the OpenCart CMS platform, mainly targeting East-Asian e-commerce websites cside.dev/blog/magecart-targ…

1
1
329
3 Jul 2025
This is what makes client-side attacks so dangerous. Dynamism is a sword that cuts both ways. Attacker leverage this to stay undetected for days, weeks and months.
2
346
22 Jun 2025
Yesterday CoinMarketCap got struck by a substantial client-side attack. Impacting all logged in users to reauthenticate their wallet access, and inadvertently grating access to a bad actor.
1
1
266
22 Jun 2025
Read our full report: cside.dev/blog/coinmarketcap…

178
10 Jun 2025
Hello from Gartner! Come visit us at booth 971 in the startup zone.
263
10 Jun 2025
We analyzed an attack on a Magento-based eCommerce site. The injection technique used hides in plain sight as the attacker is using ‘Google .com’ to deliver and execute their own code. cside.dev/blog/weaponized-go…

3
5
740
4 Jun 2025
We’re at InfoSec all week! Booth B133, come say hi!
1
2
258
21 May 2025
A new attack found in Progressive Web Apps (PWAs). They are browser-based too after all, and are also targets in client-side attacks. cside.dev/blog/chinese-adult…

2
3
376
13 May 2025
"But we use CSP so we're fine" ❌ No, you’re not. CSP was designed to protect you from things like XSS. But in reality, a CSP is blind as a bat. If you trust a vendor’s domain, CSP lets it right through. If that vendor gets compromised? CSP shrugs.

ALT Backing Up Homer Simpson GIF

1
2
367
13 May 2025
If you believe “strict CSP” is enough, look at Magecart, PII leaks, or the rise of fake browser updates. CSP couldn't save them, and neither will it save you.
1
2
262
13 May 2025
If you’re serious about client-side security, you need runtime protection that sees what scripts actually do in your users' browsers. CSP is like locking your front door while leaving the windows wide open.
1
130
7 May 2025
Thanks people at BSides and RSAC! After the conferences, we hosted a rooftop afterparty for 500 people. A great way to close out the week. Thanks to @SocketSecurity, @arcjet and @incident_io for co-hosting with us 💙
5
172