Third party script missing SRI
Your page loads JavaScript from a public package CDN with no `integrity` attribute, so the browser runs whatever that URL returns without checking it against anything.
Why it matters
Your page loads JavaScript from a public package CDN with no `integrity` attribute, so the browser runs whatever that URL returns without checking it against anything. That script has the same access to your page as your own code: your DOM, your cookies, and everything a visitor types into your forms. This is the supply-chain case, not a theoretical one. When polyfill.io changed hands in 2024 the new owner served malicious JavaScript to every site embedding it — around a hundred thousand of them — and not one had changed anything on their end. An integrity hash would have stopped it in the browser. a public package CDN serves immutable, versioned files, so the fix is safe and mechanical: pin the exact version and add the hash the CDN publishes. Better still, install the package and serve it from your own build, which removes the third party from the request path entirely.
How ShipReady detects it
Scripts loaded from a public package CDN with no integrity hash. Reads the page's own HTML and issues no requests of its own. PAGE-scoped because routes genuinely differ — a charting library pulled in only by /dashboard is invisible from the homepage — and every finding carries the script URL as its merge_key, so one bundle referenced by ten pages is one finding listing ten pages rather than ten findings.
Detection is deterministic. ShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.1.0.
How to fix it
This is the prompt ShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.
Your page loads JavaScript from a public package CDN with no Subresource Integrity hash, so the browser executes whatever that URL returns. Add an `integrity` attribute, or remove the third party from the request path entirely.
THE PREFERRED FIX IS TO SELF-HOST. `npm install` the package and import it, so your bundler ships it from your own origin. That removes an external request, a DNS lookup and a TLS handshake from your critical path, and it removes a party who can execute code on your site. The cross-domain HTTP cache that once made a shared CDN worthwhile was partitioned per-site by every major browser in 2020, so the performance argument for loading libraries from a CDN no longer holds.
IF YOU KEEP THE CDN, pin the version and add the hash. The URL must name an exact version — `.../jquery/3.7.1/jquery.min.js`, never `/latest/` or a bare package name — because a hash for a moving target breaks the moment it moves:
<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js"
integrity="sha384-..."
crossorigin="anonymous"></script>
Both attributes are required. Without `crossorigin="anonymous"` the browser cannot read the response to verify it and blocks the script, so a hash added on its own will look like it broke your site. cdnjs and jsDelivr both publish the hash next to the file; otherwise generate it with `curl -s <url> | openssl dgst -sha384 -binary | openssl base64 -A`.
DO NOT APPLY THIS TO VENDOR LOADERS. Stripe.js, Google Analytics, Google Tag Manager, Intercom and similar scripts are deliberately mutable and must stay unpinned — Stripe documents this explicitly, and pinning stripe.js breaks payments. SRI is for immutable, versioned files. For those vendors the mitigation is a Content-Security-Policy `script-src` allow-list naming exactly the hosts you intend to run code from.Frequently asked questions
- What does "Third party script missing SRI" mean?
- Your page loads JavaScript from a public package CDN with no `integrity` attribute, so the browser runs whatever that URL returns without checking it against anything.
- How serious is it?
- ShipReady rates this medium. Fix soon. Meaningfully weakens a defence or degrades how the site works.
- How do I fix it?
- Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt ShipReady puts in your report.
- Can I check my own site?
- Yes — ShipReady scans up to ten pages of any public site for free and reports this alongside every other check. The free report lists every issue it finds and shows full evidence and a fix prompt for the critical and high-severity ones; medium and low findings are counted and unlock on Pro.
Related checks
Run this check on your site
ShipReady checks this and 193 other things across up to ten pages of your site, with an AI-ready fix for each. Free, no signup.