Tag Management System: the Agile Way to Add Vulerabilities

The live Q&A follows a talk on tag management systems such as Google Tag Manager, which let marketing staff add and change scripts on a live website without a developer release. The speaker described running this kind of setup in a previous marketing role, noting that the convenience also opens doors to security problems on the front end. The talk grew partly out of cleaning up such issues and partly out of wanting others to recognise the risk early.

The discussion then turned to the tension between marketing deadlines and security review. Campaigns that launch within a day leave little time to assess every tool, so the speaker suggested splitting checks into what can be vetted before launch and what has to be watched once a script is live. The idea of shifting left was extended beyond software development to other parts of an organisation, such as marketing operations.

For practical mitigations, the speaker proposed three steps. First, audit the tag manager account itself, including who holds access and whether any permissions were delegated to outside agencies. Second, take stock of what actually runs on the website. Third, use in-browser checks that report which resources a page loads, an area that is less mature than supply chain tooling on the server side. The closing advice was to treat marketers as partners, learn their work, and approach them with curiosity rather than as adversaries.