# the_full_list
Every category, spelled out.
The bullets aren’t marketing flourish — each one is an actual detector that fires in the dashboard, an alert template that goes to Slack, or a row in your BigQuery export.
Tag fire / no-fire (the core)
under 2s on a healthy pathEvery tag, every real user session, every fire and every failure — captured in the browser, parsed, validated, scored.
- 80+ vendor pixels auto-detected (GA4, Meta Pixel, Google Ads, TikTok, LinkedIn, Pinterest, Snap, Reddit, Bing, Hotjar, Amplitude, Mixpanel, Criteo, Taboola, Outbrain, and more — no mapping config)
- Tag stops firing entirely after a deploy
- Tag fires the wrong payload (missing transaction_id, wrong event name, malformed cart array)
- Per-browser / per-OS failures (e.g. only breaks on iOS Safari)
- Per-region failures (e.g. only EU traffic affected)
- Tag fires when it shouldn't (e.g. before consent banner resolves)
Consent & privacy compliance
on the first violating sessionContinuous Consent Mode v2 verification on every real session. Not a quarterly audit. Not a synthetic crawl.
- All 7 Consent Mode v2 signals collected by the consent banner per Google's spec. Four (ad_storage, ad_user_data, ad_personalization, analytics_storage) are tracked end-to-end in audit logs; the other three (functionality_storage, personalization_storage, security_storage) are recorded per-session for compliance reasoning
- GDPR / DPDP Act / CCPA gating drift
- CMP race conditions (tag fires before the consent banner resolves)
- "Consent denied but tag still fires" violations
- PII leakage in tag payloads (emails, phone numbers, names)
Security · Magecart · PCI DSS 4.0
seconds — runs on every real checkout sessionEvery script that loads on a payment page is inventoried, SRI-checked, and diffed in real time. If a Magecart-style script appears, you know in seconds.
- Unknown third-party script on a payment page
- SRI (Subresource Integrity) hash drift on critical scripts
- CSP (Content-Security-Policy) violations from real-user reports
- Cross-origin script injection
- Tracking-hygiene allowlist drift (an unfamiliar domain appears in tag inventory)
Performance & Core Web Vitals
within 24 hours of installPer-tag attribution for LCP, INP, and CLS. Know which third-party script is eating your conversion rate.
- Per-tag LCP, INP, CLS — which specific tag slowed the page
- Render-blocking third-party scripts
- Async load failures
- Long-task attribution down to the firing tag
- P75 figures (not lab synthetic) tied to real-device, real-network sessions
Attribution & measurement quality
continuous (multi-channel reconciliation runs hourly)The gaps between what Meta reports, what GA4 reports, and what Shopify actually banked — surfaced before the finance reconciliation does.
- GA4 ↔ Shopify backend revenue gap
- Meta CAPI deduplication failures (fbp / fbc cookie timing)
- _gl linker parameter failures cross-domain
- Referrer / UTM loss
- Server-side vs client-side event divergence
- Conversion API event_id mismatches
Anomaly detection (statistical)
every 5 minutes per active workspaceA z-score on a 14-day rolling baseline, smoothed by EWMA, augmented by CUSUM for sustained drift, and decomposed seasonally so a Tuesday is compared to other Tuesdays.
- Fail rate drift
- Tag count drift (new tag appeared, old tag disappeared)
- Latency drift
- Revenue-at-risk drift
- Adaptive thresholds per workspace — no manual tuning
- The output is explained: the alert names which signal triggered, so you can debug the alert rule when it misfires
GTM / TMS change correlation
within minutes of the publish (vs hours / days manually)When a tag breaks, was it a code change, a vendor outage, or a GTM publish? We tie the anomaly start time to the publish timestamp.
- A GTM publish that broke a tag — surfaced by correlating anomaly onset with the publish event
- Trigger condition changes that silently exclude traffic (e.g. URL contains "?utm" → tag now skips deep-link landings)
- Tealium iQ / Adobe Launch / Segment / Piwik PRO equivalents on Agency Plus
- Pre/post diff at the trigger and variable level
Vendor-side outages
minutesMeta / Google / TikTok endpoints fail on their side more often than the public dashboards admit. We correlate across tenants and tell you when it's not your code.
- Meta Conversions API outages
- Google Ads pixel endpoint slowness
- TikTok Events API rejections
- Cross-tenant correlation: if 30% of TagDrishti customers see Meta CAPI 5xx in the same 30-minute window, that's a vendor outage, not your bug
Synthetic journeys (Pro+ tier)
configurable; default 15 minMulti-step user flows replayed on a schedule — useful for zero-traffic critical paths (a niche product page that rarely converts but converts large).
- Scripted checkouts on a schedule (default every 15 min, configurable)
- Form submission validation
- Behind-login flows where real users haven't completed the path yet
- Pre-launch staging audits on URLs nobody visits
- Cross-browser (Chrome, Firefox, Safari) and cross-region (US, EU, APAC, AU)
SOC 2 / compliance evidence (audit-log completeness)
daily at 02:00 UTCEvery privileged action against the platform is logged into a canonical audit_logs table. A daily agent diffs the source-of-truth against audit_logs and fires P0 if any gap exists. Built for Sprinto / Vanta / Drata pipelines.
- Admin logins via Clerk (action_type: admin.login)
- API key creation / rotation / revocation (api_key.mutation)
- Tenant impersonation sessions (tenant.impersonation)
- Billing changes via Paddle (billing.change)
- Every /api/superadmin/* call (superadmin.action)
- Daily completeness check at 02:00 UTC