ClickFix tricks users into compromising their own machines and hides its payload on a blockchain. But the attack still begins the same way: a website runs JavaScript it was never meant to run. That’s where we could have stopped it. blog.report-uri.com/the-clickfix...

The ClickFix Attack We Could Have Stopped

A customer forwarded us something last week that has stuck with me. It was a live attack campaign — a good one, in the professional-admiration sense — along with a detailed public write-up dissecting ...

blog.report-uri.com

Stripe just made CSP a compliance requirement. Merchants completing their annual PCI assessment are now asked to attest that they’ve deployed a Content Security Policy. That’s a major shift from “you should deploy CSP” to “confirm that you have.” Full details: blog.report-uri.com/stripe-now-a...

Onboarding just got a whole lot easier! 🤖 Using Claude, ChatGPT, Gemini, or another AI agent? Login, click "Copy Prompt", paste it into your AI, and it'll configure CSP reporting for you. Get up and running in minutes 😎 report-uri.com

We've released a new version of report-uri/dbsc-php thanks to community contributions! Full details: github.com/report-uri/d... Background: scotthelme.co.uk/open-sourcin...

Releases · report-uri/dbsc-php

Contribute to report-uri/dbsc-php development by creating an account on GitHub.

github.com

We’ve open-sourced passkeys-php, the WebAuthn library we use at Report URI, to help the community deploy passkeys more easily and safely. Small. Auditable. MIT licensed. Built for real-world PHP apps. Our founder, @scotthelme.bsky.social, shared the details today: scotthelme.co.uk/open-sourcin...

Great research from our founder, @scotthelme.bsky.social, on one of the hidden risks of passkeys. Passkeys reduce phishing risk, but malicious JavaScript in the browser can abuse registration and create persistent account takeovers! Client-side visibility matters. scotthelme.co.uk/xss-is-deadl...

XSS Is Deadly for Passkeys: The Hidden Risk of Attestation None

A single XSS vulnerability can turn passkeys from a phishing-resistant login mechanism into a persistent account takeover backdoor. If malicious JavaScript can run on your page, it may be able to regi...

scotthelme.co.uk

Passkeys are becoming a major part of how we secure accounts online, but there’s still confusion about how they work, and what risks remain. Our founder, @scotthelme.bsky.social, has written an intro to Passkeys before we publish deeper technical posts this week. scotthelme.co.uk/passkeys-101...

Passkeys 101: An Introduction to Passkeys and How They Work

Passwords have been the weak point in online authentication for decades. They can be reused, guessed, stolen, phished, leaked, sprayed, stuffed, and captured by malware. Passkeys are one of the first ...

scotthelme.co.uk

A checkout page can look secure, work normally, and still be stealing customer payment data. @scotthelme.bsky.social breaks down a real-world JS compromise where attackers skimmed card data from the page, and why orgs need visibility into the code they're running. scotthelme.co.uk/anatomy-of-a...

Anatomy of a WooCommerce Skimmer: A Technical Deep-Dive

One malicious change to a trusted JavaScript file can turn your checkout page into a silent credit-card skimmer, siphoning customer data off to criminals while the website looks secure and continues t...

scotthelme.co.uk

Q2 is off to a busy start at Report URI 🚀 🔹 API/MCP endpoints GA 🔹 Audit Trail to Webhook 🔹 Custom Fingerprints for JS 🔹 Audit Archive for JS 🔹 Reporting API in @firefox.com 🔹 Deeper CSP inspection 🔹 Passkeys research + whitepaper 🔹 New Threat Intel research blog.report-uri.com/newsletter-a...

Newsletter - Apr 2026

As we continue to push into 2026, we’ve maintained our pace of improving existing features and introducing new ones. API and MCP endpoints - now Generally Available 🤖 Our API and MCP endpoints are...

blog.report-uri.com

The NCSC is right to push passkeys. They’re a huge step forward for authentication: phishing-resistant, no shared secret on the server, far better than passwords in many ways. But passkeys don’t make your application trustworthy after login!

Good morning Glasgow! 🏴󠁧󠁢󠁳󠁣󠁴󠁿 Come and find us at CyberUK booth G13 and see how we can show you exactly what code is running on your website. 👨‍💻 #CYBERUK26

The Report URI refresh is live! 💙🧡 New homepage, refreshed product + case study pages, all-new social cards across the site, and more. Same mission: catching the third-party code your website is running that you don't control. ➡️ report-uri.com

Client-Side Security and Observability.

Protect user data and prevent client-side data breaches with real-time browser security controls.

report-uri.com

We're tracking an active Magecart campaign targeting ecommerce sites. The malware hides from admins, adapts to the platform, and changes how it steals payment data! Write-up: scotthelme.co.uk/fighting-an-...

Fighting an active Magecart Campaign

We’ve been tracking an active Magecart campaign targeting ecommerce sites, with payloads customised per victim and evasion logic designed to stay hidden from site owners. We spotted it because we moni...

scotthelme.co.uk

We uncovered a malicious browser extension injecting JavaScript Malware into pages, hijacking clicks, and monetising user traffic right inside the browser! scotthelme.co.uk/amazing-refr...

Amazing Refresh — A Malicious Chrome Extension Running Malware in the Browser

We recently uncovered a malicious browser extension affecting visitors to customer websites. It injected JavaScript into pages, hijacked outbound clicks through affiliate infrastructure, and quietly m...

scotthelme.co.uk

Our founder has just published a write-up on having our Passkeys implementation independently security tested. Auth is too important to just ship and hope for the best, so we brought in the experts! scotthelme.co.uk/bringing-in-...

Bringing in the experts; Having our Passkeys implementation Security Tested

We recently announced support for Passkeys on your Report URI account, and everyone should go and enable Passkeys for the amazing security benefits they offer. As a new implementation of an authentica...

scotthelme.co.uk

Our March update was a big one! 😎 🤖 API and MCP Endpoints 🔑 Passkeys support 📈 Report Sampling 🛡️ Integrity Suite 📋 Audit Trail 👀 Visual updates And loads more! blog.report-uri.com/newsletter-m...

Newsletter - Mar 2026

Both January and February were big months for us at Report URI HQ, and we have continued to push forwards in March! API and MCP endpoints - beta invites! 🤖 Starting out with what has to be our mos...

blog.report-uri.com

We’re inviting customers to join the beta for our new API and MCP integrations. Bring Report URI data into AI assistants, automations, dashboards, and custom security tooling. Want in? Details in our newsletter: blog.report-uri.com/newsletter-m...

Newsletter - Mar 2026

Both January and February were big months for us at Report URI HQ, and we have continued to push forwards in March!

blog.report-uri.com

At the scale we operate at, “one in a billion” problems can happen every single day! In our latest blog post, we share some of the challenges that come with operating Redis at scale, and what it takes to keep a high-volume telemetry pipeline fast and resilient. scotthelme.co.uk/when-one-in-...

When “One in a Billion” Happens Every Day: Scaling Redis at Report URI

Something that I've come to learn as we continue to grow Report URI is that everything is easy until scale makes it hard. We're now processing so much telemetry that a "one in a billion" problem can h...

scotthelme.co.uk

We're starting to see some really positive results with more customers using our CSP Integrity feature! scotthelme.co.uk/leverage-our...

Leverage our treasure trove of Threat Intelligence data

We've been working on CSP Integrity for a little while now, and it was only announced in open beta back in September. Since then, as more of our customers start to use it, we've continued to improve i...

scotthelme.co.uk

Today is your last chance to catch us at @ndcconferences.com Security in Oslo! We’ve had a great week of workshops, talks and conversations at the booth. Stop by for a chat with our founder @scotthelme.bsky.social about his talk “Your website is running code you’ve never seen!”

Big update from Report URI 🚀 ✅ Report Sampling in Open Beta ✅ Audit Trail in Open Beta ✅ Alert thresholds for all Watch products ✅ New Magecart case study ✅ CSP Integrity webinar recording live ✅ Find us at NDC Security Oslo 4–5 Mar, CyberUK Glasgow 21–23 Apr blog.report-uri.com/newsletter-f...

Newsletter - Feb 2026

After kicking 2026 off with a pretty big update, we've continued to push forwards with a lot of work across the board at Report URI HQ.

blog.report-uri.com

A recent security incident at a space agency highlighted a growing and often misunderstood risk: modern websites increasingly depend on third-party JavaScript, and that code runs with the same privileges as your own. report-uri.com/case_studies...

Case Study - European Space Agency

The European Space Agency was hit by a Magecart attack during Christmas 2024, and we could have stopped it

report-uri.com

Eating Our Own Dogfood: What Running Report URI on Report URI Taught Us scotthelme.co.uk/eating-our-o...

Eating Our Own Dogfood: What Running Report URI on Report URI Taught Us

Dogfooding is often talked about as a best practice, but I don't often see the results of such activities. For all new features introduced on Report URI, we are always the first to try them out and se...

scotthelme.co.uk

As is tradition, we've completed our annual penetration test and the results have been published publicly for all to see! Curious what was found, what we've done to resolve issues, or what a penetration test report looks like? Come and have a read! scotthelme.co.uk/report-uri-p...

Report URI Penetration Test 2025

Every year, just as we start to put up the Christmas Tree, we have another tradition at Report URI which is to conduct our annual penetration test! 🎅🎄🎁 --> 🩻🔐🥷 This will be our 6th annual penetratio...

scotthelme.co.uk

We’re ready for @blackhatevents.bsky.social EU! Are you? 😎 #BHEU

Do you want to quickly and easily know if all of your JavaScript assets across your site are using SRI? Now you can! Announcing the open-beta of Integrity Policy! scotthelme.co.uk/integrity-po...

Integrity Policy - Monitoring and Enforcing the use of SRI

This has been a long time coming so I'm excited that we now have a working standard in the browser for monitoring and enforcing the use of SRI across your website assets! SRI refresher For those...

scotthelme.co.uk