> Does vetting necessarily help? If I send some JS through for your adops to traffic, and they call code on my own adserver, what's to stop me from altering it after you have trafficked it and it's already live showing to users?

You can let your advertisers run JavaScript in ads without letting them inject script tags pointing to external URLs. There's no risk in the script changing if you're only hosting inline code they have no access to after review.

There's many (perfectly legitimate) buyers out there for whom this would be a deal breaker. If you don't run the adverts through my server (i.e. including using JS on my adserver) then you won't be serving my adverts. And in the world of media buying, that's not at all uncommon.

> let your advertisers run JavaScript in ads without letting them inject script tags pointing to external URLs

How would you do that? That's equivalent to the halting problem. There is an infinite number of ways to assemble code that will execute arbitrary code, which can can assemble code that will execute arbitrary code, which ...

It means that every piece of the code must be examined by a human. That's expensive.

D'oh! Just wrote you back. My bad.

So the vetting we do is somewhat extreme. We ask you to sign on as an enterprise customer to run ads like that. Making things more official tends to weed people out pretty quickly and leaves us just the well-intending players.