Skip to main content
Web script monitoring (Developer Mode)
Language

Web Script Settings

Control whether the cside web script runs and which release channel is served, using the Developer Mode and release channel settings in Team Settings.

Three controls live under Team Settings > General: Developer Mode, Web Script Release Channel, and Page URL query strings. Open the Settings gear in the sidebar footer and select General. Changes require Manage Team permission.

Web script monitoring (Developer Mode)

Developer Mode controls the automatically updated cside web-script URLs for every domain in the team:

  • Off (default): cside serves the monitoring script, including detections and configured blocking controls.
  • On: those URLs serve an empty JavaScript file, pausing web-script monitoring and protection. Device Intelligence is a separate product and is not affected.
Pinned scripts keep their original behavior

An installed SRI-pinned script is immutable. Changing Developer Mode does not change its bytes or original configuration. Remove or replace that tag on your site to change its behavior.

You can use the toggle in Team Settings > General, the sidebar control, or Resume in the app-wide banner. All use the same team setting. Enabling Developer Mode asks for confirmation; resuming does not. Only members with Manage Team can change it. Allow time for updated configuration to reach edge locations.

Web Script Release Channel

  • Latest (default) serves the newest released build.
  • Stable serves a more conservatively vetted build for teams that want extra change control.

The channel is set for the whole team; there is no per-domain override. Changes take time to reach edge caches. Stable is a release channel, not an immutable SRI installation. An installed pinned tag must be replaced to receive new code or configuration.

Page URL query strings

By default, cside stores the full page URL, including its query string. Enable removal to strip query strings from page URLs in new results before storage. Previously stored URLs and script URLs are unchanged.

This can reduce exposure of tokens or codes carried in page URLs, but it is not a guarantee: if the setting cannot be read, processing continues without stripping, and a browser may send a full URL through another path such as a cross-origin Referer header. Avoid putting secrets in URLs where possible.

Was this page helpful?