Who Can Change the Script After You Ship It? A Proposed Axis for Third-Party Script Integrity (September 2026)
A script element without integrity metadata does not request a specific script. It requests whatever the host at that address is serving when a visitor arrives. A pre-registration for a third-party script integrity axis, with the two specifications that make the half-fix fail harder than the no-fix.
22 min read11