1. A method of enforcing a client-side security policy, comprising: receiving a security policy from a server at a client, the security policy being a script function contained in a portion of a document including a client-side script; monitoring a client-side script execution process; determining if the client-side script execution process complies with the security policy; and transforming a mutation if the client-side script execution process does not comply with the security policy in order to enforce the security policy, wherein transforming comprises modifying a portion of the document by rewriting code or data that does not comply with the security policy.