Vorpcel // Outbound Control

Control what your application
sends back to the browser.

The firewall guards the request coming in. Outbound Control guards the response going out: script integrity, data leaving to third parties, and the hygiene of every response, inspected at the edge with no change to your application.

01

Client-side integrity

Know and pin every script that runs on your page, and catch tampering or skimmer behavior before a single card number leaves the browser.

02

Response hygiene

Security headers, cookies, CSP, CORS, mixed content, SRI, redirects and exposed files, the objective checks that harden every response, including your API (JSON) responses, verified continuously.

03

Behavioral watch

Where data goes and how each page changes over time: exfiltration to new destinations and supply-chain drift, flagged the moment they appear.

§ 02

Know every script that runs on your page.

Modern pages load code from many places, and any one of them can be the weak link. Outbound Control inventories every script and content-hashes it against the baseline you approved. When an approved script changes, or a known skimmer technique appears in one that executes, you know at once.

Full script inventory
Every first- and third-party script on the page, listed with its origin.
SHA-256 baseline & tamper detection
Approve a script once; any later change to its content is flagged immediately.
Anti-skimming signatures
Magecart techniques such as eval+atob, self-removing injection and card-field capture, caught over the code that actually runs.
Script inventorycheckout page
pay.js
cdn.thirdparty.io
tampered
checkout.js
js.stripe.com
baseline
app.bundle.js
self
baseline
analytics.js
tag.vendor.com
baseline
9 scripts inventoried1 changed since baseline
§ 03

Nothing leaves to a destination you never approved.

Outbound destinationscheckout page
js.stripe.com
payment SDK
approved
api.example.com
first-party API
approved
collect.unknown.net
new external form
drift
exfil.badhost.io
unapproved beacon
exfil
baseline pinned 12 days ago2 new destinations

A breach shows itself when data starts flowing to a host that was never part of your application, or when a new external script or form quietly appears on a page. Outbound Control pins the destinations and the external surface of each page as a baseline, and flags anything new the moment it shows up.

Outbound destinations
Every host that receives data over fetch, XHR, beacons or form submissions, checked against what you approved.
Response-surface drift
A new external script, iframe or form target appearing on a page is a classic supply-chain injection, and it is flagged at once.
Baseline you control
Approve a destination or an external party once; only genuinely new surface raises an alert.
§ 04

Every response, checked for the basics that matter.

A missing header or an insecure subresource is the kind of gap that never shows up until it is exploited. Outbound Control verifies the hygiene of every response against objective criteria, so the gaps surface before an attacker finds them, and each finding points to exactly what to fix.

Headers & cookies
HSTS, nosniff, clickjacking protection, Referrer-Policy, Permissions-Policy, and cookie flags.
CSP, mixed content & SRI
Policy weaknesses, insecure http subresources, and cross-origin scripts loaded without integrity.
Header injection at the edge
Set the headers and CSP you want per domain and the edge applies them on every response, with no code change.
Response hygieneapp.example.com
Strict-Transport-Securitymissing
Content-Security-Policyweak
Secure / SameSite cookiesok
Mixed content1 found
Subresource Integrity2 missing
Exposed filesnone
§ 05

See what happens after the page loads.

Response posture

checkout.example.com

B · 84/100
Tampered scriptcritical
New external formdrift
Missing security headerreview
Score moves as your team resolves each finding.

A lightweight agent runs in your visitors' browsers and reports what actually executes, while the edge inspects every response in parallel. Everything rolls up into a single posture score, so leadership sees one number and engineering sees the findings behind it.

Client-side telemetry
What loads and where data goes, observed from the browser itself.
One posture score, A to F
Every detector rolls into a single grade that moves as findings are resolved.
Context on every alert
Each finding carries its page, source and severity, ready to triage.
PCI DSS

Evidence your auditors will ask for.

Script management and change detection are exactly what payment-security requirements expect on a checkout page. Outbound Control keeps the record for you: the scripts running, their approval, and every change over time, ready to export. It maps directly to PCI DSS 6.4.3 and 11.6.1.

PCI DSS 6.4.3covered

Management and integrity of every script on the payment page.

PCI DSS 11.6.1covered

Detection and alerting on unauthorized changes to the payment page.

Start now

Take control of
what your application sends back.

Free trial, no credit card required. Point a domain and watch the response side in the dashboard.