Supply chain and setup Required

Load third-party scripts with integrity checks

Host scripts yourself unless the provider requires its own server, such as a payment script. When a script must come from another server, pin its version and add an integrity hash.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Copy fixed libraries into your own build. For a script from a CDN, add integrity and crossorigin. Allow it in the Content Security Policy by its hash, or load it from a hashed or nonced script, as the CSP rule says. Host lists are ignored under 'strict-dynamic'. See the website integrity rule. The privacy side is in host everything yourself for privacy.

Example

<script src="https://cdn.example.net/lib@2.1.0/lib.min.js"
  integrity="sha384-…" crossorigin="anonymous"></script>

How to check

Change one byte of a pinned script on staging. The browser refuses to run it and logs an integrity error.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/third-party-scripts.