Custom HTML tags: the code in your container nobody reviewed

A Custom HTML tag is arbitrary JavaScript, delivered to every visitor, deployed by whoever has container access — with none of the review your application code goes through.

What it is

Most GTM tags are templates: you fill in fields and the platform generates the request. A Custom HTML tag is different — it is a block of markup and JavaScript that GTM injects into the page verbatim. It can do anything a script on your site can do, because that is exactly what it is.

That includes reading the DOM, reading cookies and storage, adding event listeners, and loading further scripts from anywhere on the internet.

Why it concentrates risk

It bypasses code review. Your application JavaScript goes through pull requests, CI and deploys. A Custom HTML tag goes through a textarea and a Publish button, and it reaches production the moment someone clicks it.

The people with access are usually not engineers. That is the point of GTM, and it is a genuinely good thing — but it means the deploy path with the least review is also the one with the fewest engineering eyes.

It is invisible to your repository. Nothing in your codebase records that the tag exists. Search your repo for the vendor it loads and you will find nothing.

It can load code you never see. A tag that injects a third-party script has delegated to whatever that vendor serves today, which is not necessarily what they served when it was reviewed.

How common it is

Across 42,089 audited containers, 81.5% ship custom code — 76.3% carry at least one Custom HTML tag. This is not a fringe practice or a sign of a badly run team. It is how GTM is used.

That prevalence is the reason we report it as an information finding rather than a problem. Common and harmless are different claims: a practice can be in every container and still be the largest unreviewed surface you have.

What to do about it

You cannot review what you cannot read, and the GTM UI shows one tag at a time. Export the code to files: tagora xray GTM-XXXXXXX --dump ./gtm-review writes every custom tag and variable as a separate file, which your editor, your grep and your AI assistant can all read at once.

From there the useful questions are ordinary code-review questions. What does it load, and from where? Does it write cookies or storage? Does it use document.write, eval, or innerHTML with anything user-controlled? Is it still needed at all?