A stylesheet loads without an integrity check
Your page loads CSS from a public package CDN with no `integrity` attribute, so the browser applies whatever that URL returns without checking it.
Why it matters
Your page loads CSS from a public package CDN with no `integrity` attribute, so the browser applies whatever that URL returns without checking it. A hostile stylesheet is not just a defacement risk. CSS attribute selectors can match on the value of a form field and request a background image per character, which leaks what someone is typing one keystroke at a time to whoever controls the sheet. `content` and `display` rules can also rewrite what the page appears to say — moving a button, hiding a warning, changing a displayed price. It is a smaller risk than an unpinned script, which is why this is reported below one: CSS cannot read your cookies or call your API. The fix is identical though — a public package CDN serves immutable, versioned files, so pin the version and add the hash, or install the package and serve it from your own build.
How ShipReady detects it
Scripts loaded from a public package CDN with no integrity hash. Reads the page's own HTML and issues no requests of its own. PAGE-scoped because routes genuinely differ — a charting library pulled in only by /dashboard is invisible from the homepage — and every finding carries the script URL as its merge_key, so one bundle referenced by ten pages is one finding listing ten pages rather than ten findings.
Detection is deterministic. ShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.1.0.
How to fix it
This is the prompt ShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.
A stylesheet on your page is loaded from a public package CDN with no Subresource Integrity hash, so the browser applies whatever that URL returns. The fix is the same shape as for a script, and the reasoning is worth knowing because CSS looks harmless.
WHY A STYLESHEET MATTERS. CSS attribute selectors can match on the VALUE of a form field and request a background image per match, which leaks what someone is typing one character at a time to whoever controls the sheet. `content`, `display` and `position` rules can also move a button, hide a warning or change a displayed price. CSS cannot read your cookies or call your API — which is why this is ranked below the script equivalent — but it is not inert.
PREFERRED FIX: SELF-HOST IT. `npm install` the package and let your bundler emit the CSS from your own origin. That removes a render-blocking cross-origin request from your critical path as well as removing the third party.
IF YOU KEEP THE CDN, pin the exact version and add the hash. Both attributes are required — without `crossorigin="anonymous"` the browser cannot read the response to verify it and blocks the stylesheet, so a hash added alone will look like it broke your styling:
<link rel="stylesheet"
href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css"
integrity="sha384-..."
crossorigin="anonymous">
cdnjs and jsDelivr publish the hash beside the file; otherwise generate it with `curl -s <url> | openssl dgst -sha384 -binary | openssl base64 -A`.
DO NOT APPLY THIS TO A VENDOR'S THEME URL. If a SaaS product gives you a stylesheet it updates on its own schedule, pinning it breaks the styling the next time they ship. SRI is for immutable, versioned files.Frequently asked questions
- What does "A stylesheet loads without an integrity check" mean?
- Your page loads CSS from a public package CDN with no `integrity` attribute, so the browser applies whatever that URL returns without checking it.
- How serious is it?
- ShipReady rates this low. Worth fixing. Small individually, and they accumulate.
- How do I fix it?
- Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt ShipReady puts in your report.
- Can I check my own site?
- Yes — ShipReady scans up to ten pages of any public site for free and reports this alongside every other check. The free report lists every issue it finds and shows full evidence and a fix prompt for the critical and high-severity ones; medium and low findings are counted and unlock on Pro.
Related checks
Run this check on your site
ShipReady checks this and 193 other things across up to ten pages of your site, with an AI-ready fix for each. Free, no signup.