# Vendors

> Reference for Security > Vendors: vendor statuses, what the details sheet shows, what Allow and Block do, the pinned rows and the Pro features.

Source: https://docs.scriptmonitoring.com/vendors/ · Plan: All plans · Updated 2026-10-13

**Security > Vendors** lists every third party observed on your pages in the top bar's date range, one row per vendor, with one decision each: **Allow** approves it and records what it is allowed to do, **Block** stops every resource it serves on all of the team's domains. Alerts and the PCI DSS evidence use the same decision. To review vendors step by step, [follow the guide →](https://docs.scriptmonitoring.com/guides/approve-or-block-a-vendor/).

![Vendors: every third party seen on Payments platform in the last 7 days with its category, review status, highest score and what it does on the page, plus Allow and Block.](https://docs.scriptmonitoring.com/screenshots/vendors-light.webp)

## What do the statuses mean?

| Status | Meaning |
| --- | --- |
| Approved | Someone allowed the vendor and it has no open alerts. |
| Needs review | Nobody has decided yet, or it raised an alert since. |
| Blocked | Every resource it serves is stopped on all of the team's domains. |

## What does a vendor's details sheet show?

- **Why it scored**: the rule behind its risk score, or "Not scored" if none of its scripts raised an alert.
- **Load chain**: whether your page loads it directly or another vendor does (Pro and Enterprise).
- **PCI DSS 4.0.1**: whether it runs on a payment page, and whether it has a recorded justification.
- **Seen pages**: the pages it runs on, each marked **Payment page** or **Not a payment page**.
- **What it does on the page** and **Permissions** (per-vendor permissions are Pro and Enterprise).
- The **Sub-scripts** and **Alert rules** tabs.

## What does Allow do?

**Allow** approves the vendor: it lifts the vendor's block, if it had one, and records an explicit allow for everything the vendor was seen doing. The vendor turns **Approved** once it has no open alerts. Allowing from **Security > Alerts** also resolves the vendor's open alerts.

## What does Block do?

**Block** stops every resource the vendor serves (not only scripts, but images, fonts, frames, stylesheets and any other request) on every domain in the team, after you give a reason. How this compares with blocking from an alert: [Should I block from Alerts, Vendors or Blocks?](https://docs.scriptmonitoring.com/blocks/#should-i-block-from-alerts-vendors-or-blocks).

## What are the two pinned rows?

- **Default configuration** applies to every script unless a vendor's configuration overrides it. Its badge says **Allows by default**, **Blocks by default** or **Custom default**.
- **Inline code** covers inline sources and `data:` URLs. It has no vendor to block.

## What else is in a row's menu?

**Open vendor details**, and **Reset reviewed permissions**, which sends the vendor back to needing review.

## Frequently asked questions

### What does "Needs review" mean?

Nobody has decided on the vendor yet, or it raised an alert since it was approved. Alerts and Vendors share this status.

### Why can't I see the load chain or per-vendor permissions?

The vendor load chain and per-vendor permissions are included in Pro and Enterprise. Allowing and blocking a vendor work on every plan.

### Can I undo an Allow or a Block?

Yes. Allow shows an **Undo** in its toast, and allowing a blocked vendor lifts its block.

## Related

- [Approve or block a vendor (guide)](https://docs.scriptmonitoring.com/guides/approve-or-block-a-vendor/)
- [Alerts](https://docs.scriptmonitoring.com/alerts/)
- [Blocks](https://docs.scriptmonitoring.com/blocks/)