- Review observed cookie names and domains without collecting their values.
- Keep external hosts separate from confirmed service classifications.
- Record the conditions under which the inventory was observed.
Replace assumptions with an observed inventory
Website dependencies change as teams add analytics, videos, support tools and advertising integrations. A list copied from last year’s documentation may no longer describe the current site. A browser-based inventory provides a view of what was actually observed during a particular visit.
TruCookie records cookie names and domains, outbound hostnames and storage key names. It does not collect cookie values, request bodies or form input in the described scanning workflow.
Separate the evidence from the explanation
An observed hostname identifies a destination contacted by the browser. It does not prove why the request occurred or which internal team owns the integration. Follow up with the website owner to classify the purpose.
Cookie names also need context. A name is not a reliable universal identifier of purpose, and third-party requests do not always create cookies. Keep these inventories connected, but do not treat them as interchangeable.
Use the inventory in a review process
Record the page, scenario and timestamp alongside the observations. Assign unfamiliar services to a reviewer and document the decision. Repeat the review after a significant site release.
An inventory describes tested behavior; it is not a declaration that every cookie or endpoint has been found. Public scanning remains closed while production isolation and security review are completed.