docs, added path whitelisting to script attribute, added more comments and logs