Do scripts from other sites carry an integrity hash?
The subresource integrity check reads whether scripts and stylesheets your pages load from other sites carry an integrity hash. With one, the browser refuses a file that changed.
What does this check look at?
It looks at whether scripts and stylesheets loaded from other sites carry an integrity hash the browser can check. MDN says SRI lets browsers verify that fetched resources are delivered without unexpected manipulation. OWASP names the single greatest risk of third-party scripts as a compromise of the third party JavaScript server.
Pulse and Deep scans both run it.
What does a result mean?
| What the report shows | What it means | What to do |
|---|---|---|
| No finding | External files carry usable integrity hashes. | Nothing. |
| Low or medium finding | Some external files have no usable hash. | Add hashes to versioned files, or host them yourself. |
It does not show that a provider ever served harmful code. Files that change on purpose, such as an analytics loader, cannot use a fixed hash. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.
How serious is a finding?
Treat this as a hardening gap. It makes an attacker’s job easier but gives them no path of its own, so fix it after anything more direct. Confidence starts low, because it is inferred from headers or declarations rather than shown directly. The report lists what to fix by how directly someone could use it, not by the severity label.
What does a confirmed finding have to show?
| Part | For this check |
|---|---|
| Where it starts | The company hosting a third-party script or stylesheet |
| The protection that should stop it | No Subresource Integrity check on the tag |
| What is reached | Their code runs on your page |
| What follows | Only if that company is broken into; no weakness of your site on its own |
Which standards does it relate to?
| Standard | Reference |
|---|---|
| OWASP Top Ten | A08:2025 Software or Data Integrity Failures |
| CWE | CWE-353 |
| CWE | CWE-494 |
| ASVS | v5.0.0-3.6.1 |
Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.
Fix it with your AI
Pin a version, hash it, or host the file with your site.
Find every script and stylesheet my pages load from another domain. For each one that points to a fixed, versioned file, add an integrity attribute with its sha384 hash and crossorigin="anonymous". For files that change by design, such as analytics or chat loaders, leave them as they are and list them for me. Where a library is available on npm, suggest bundling it with my site instead.How to check
Say Atlas, our example app at atlas.example, loads a charting library from a public CDN with no hash. The check names the tag, and pinning the version with a hash fixes it.
Run a Pulse scan from your Lockpick account to see it for your site. Pulse or Deep explains what each scan reads, and the full list of checks shows the rest.
Questions people ask
Does a missing hash mean the file is malicious?
No. It only means the browser would not notice if the file changed. Nothing suggests the provider served anything harmful.
Why can my analytics script not have a hash?
Its provider updates the file without changing the address, so any fixed hash would break it. Review such scripts and keep the list short.
See what your site shows from outside
A quick check reads your homepage the way a visitor would and gives you a score. No account needed.
Check your siteSources
- How we rate findings Lockpick docs, read on October 7, 2026
- Subresource Integrity MDN Web Docs, read on October 7, 2026
- Third Party JavaScript Management Cheat Sheet OWASP Cheat Sheet Series, read on October 7, 2026