practitioner hardening supply-chain web
Third-party JavaScript on your pages: inventory, Subresource Integrity and CSP
A script tag that loads from someone else's server runs with your page's full authority. What can go wrong when that provider is breached, what Subresource Integrity and Content Security Policy do and do not stop, and a short checklist for login, payment and account pages.