Safeguard
Supply Chain•

Does your Unity WebGL template load scripts nobody has reviewed?

A Unity web template is the HTML and JavaScript page around your game. Treat its scripts, analytics tags and CDN links as dependencies and review them.

Safeguard Security Team
3 min read

Often yes. A Unity web template is a hand-built HTML page that hosts your game, and anyone can add analytics, ad or social scripts to it. Those scripts load in the same page as your game, so list each one, pin where you can and review changes.

What the template is

Unity's documentation says web templates control the appearance of the HTML page that hosts your Web Player. It also says you need prior knowledge of JavaScript concepts to use the feature. A template's index.html file creates an instance of your content with a function called createUnityInstance, and templates support preprocessor variables, JavaScript macros and conditional directives.

In plain terms, the template is a small web application wrapped around your game build. It is ordinary front-end code, with ordinary front-end risks.

What tends to accumulate in it

  • Analytics or tag manager snippets added by marketing.
  • Ad network or monetization scripts.
  • Social share buttons or login libraries.
  • Fonts and style sheets loaded from other hosts.
  • Copies of helper libraries pasted in years ago.

Each is a third-party dependency that does not appear in any Unity package manifest.

A review routine

  1. Open the template folder and read index.html end to end.
  2. List every script and link tag that points off your own host. Record the URL, purpose, owner and date added.
  3. For each, ask whether it is still needed. Remove what is not.
  4. For libraries you host yourself, record the version. For ones loaded from another host, decide whether to self-host a pinned copy.
  5. Where your hosting allows, add a content security policy that lists the hosts you expect. This limits what a new tag can pull in.
  6. Put the template folder under pull request review, with an owner for changes.
  7. Re-check after each release, as a template is easy to forget when the game itself has not changed.

Because the page runs in a visitor's browser alongside your game, anything a script can reach in the page, including a player's session on your own site, is within its reach. Keep game sites separate from account sites where you can, such as on a different host name.

How this connects to your other inventories

Web template scripts belong in the same record as engine packages, plugins and SDKs. Our post on third party SDKs in games and creator apps lists the data questions to ask about any SDK that arrives through a template.

Try it yourself

Click through it at your own pace, or open it full screen.

Look at how the demo lists each component with its version, then list your template scripts the same way.

Quick check

Does a web template appear in Unity's package manifest?

No. It is a folder of HTML and JavaScript, so any scripts it loads need their own inventory.

Do I need JavaScript knowledge to use templates?

Yes. Unity's documentation says prior knowledge of JavaScript concepts and terminology is needed for the templates feature.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.