| 1 | # Browser Asset Audit |
| 2 | |
| 3 | For browser-delivered JavaScript or CSS, inspect the complete generated output |
| 4 | for: |
| 5 | |
| 6 | - CSP requirements and dynamic code execution; |
| 7 | - injected markup, scripts, or styles; |
| 8 | - network destinations and runtime loading; |
| 9 | - external URLs, source maps, and runtime fetches; |
| 10 | - bundled code or notices absent from upstream top-level metadata. |
| 11 | |
| 12 | Every destination and executable behavior must be attributable to the selected |
| 13 | upstream release. Resolve or report suspicious content before completion. |