---
title: "Load third-party scripts with integrity · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/third-party-scripts
updated: 2026-10-20
licence: "All rights reserved"
---

# Load third-party scripts with integrity checks

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)
- Rule: Host scripts yourself unless the provider requires its own server, such as a payment script. When a script must come from another server, pin its version and add an integrity hash.
- How: Copy fixed libraries into your own build. For a script from a CDN, add `integrity` and `crossorigin`. Allow it in the Content Security Policy by its hash, or load it from a hashed or nonced script, as [the CSP rule](https://agentwranglers.se/playbook/website/security/content-security-policy) says. Host lists are ignored under `'strict-dynamic'`. See the [website integrity rule](https://agentwranglers.se/playbook/website/security/subresource-integrity). The privacy side is in [host everything yourself for privacy](https://agentwranglers.se/playbook/website/privacy/third-party-scripts).
- Check: Change one byte of a pinned script on staging. The browser refuses to run it and logs an integrity error.

Example:

```html
<script src="https://cdn.example.net/lib@2.1.0/lib.min.js"
  integrity="sha384-…" crossorigin="anonymous"></script>
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/third-party-scripts`.

- Previous: [Review every new package](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/review-new-packages)
- Next: [Keep secrets out of builds from strangers](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/ci-secrets)
- [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)