Scan rule · RSC-SEC-097
Third-party scripts without Subresource Integrity
Finds `<script src>` and `<link rel=stylesheet>` from public CDNs (cdnjs, jsDelivr, unpkg, jQuery, Bootstrap …) without an `integrity` attribute.
Why this matters
A script from a foreign CDN runs with all the rights of your page: it sees form input, sessions and payment fields. You are trusting not only the library but anyone who can swap the file on the CDN — through a breach at the provider, a taken-over domain or a tampered release. That is exactly how the polyfill.io attack of 2024 hit over a hundred thousand sites.
Subresource Integrity is the browser's answer: a hash in the tag that it compares with the loaded file before executing anything. If it does not match, nothing runs. For versioned CDN files this is one line — most CDNs display the ready-made tag including the hash. It does not apply to scripts that update themselves (tag managers, analytics); those are therefore not counted here.
Check it yourself: open the source and search for `<script src="https://cdn` — if the tag has no `integrity=`, the protection is missing.
Scan tier
How to fix it
Generate the SRI hash for every CDN include (`openssl dgst -sha384 -binary file.js | openssl base64 -A`) and add it as `integrity` together with `crossorigin="anonymous"` — or host the file yourself.