Script integrity (SRI)
Subresource Integrity pins a script to a hash of its contents. If the file changes, the hash no longer matches and the browser refuses to run it. That is how you catch a compromised CDN or a tampered build — and it is why the feature has two halves that must be understood separately.
Monitoring and enforcement are different things
Conflating them is what breaks sites, so we keep them apart:
| Mode | What happens | Risk to your page |
|---|---|---|
| Monitoring (SRI enabled) |
We inventory the scripts and stylesheets your pages load, hash each one, and alert you when the content behind a URL changes. | None. Nothing is added to the page. |
| Safe Mode (enforcement) |
We add the integrity attribute. A file whose contents changed is refused by the browser until you approve the new version. |
Real. That refusal is the protection — and it applies to legitimate updates too. |
Monitoring is on as soon as you enable SRI and answers the question compliance frameworks ask: what scripts run on this page, and would you know if one changed? Safe Mode is the opt-in step that turns knowing into stopping.
How the inventory builds itself
You do not list anything by hand. The edge notes which subresources each page loads and reports them back; we then fetch each one and compute its SHA-384 hash out of band, so no visitor ever waits on it.
- First sighting — the hash is recorded as the baseline and approved automatically. A script that has always been there is not a finding.
- Contents changed — that is a security event. With Safe Mode off you get an alert and the new version is approved. With Safe Mode on it is held for your review, and the browser refuses the file until you approve it.
Turning on Safe Mode
Before enabling it, go through the SRI Bypass Hosts list. This is the single most common cause of a page breaking, and it is avoidable.
| Kind of URL | Example | Safe to pin? |
|---|---|---|
| Versioned | /normalize/8.0.1/normalize.min.css |
Yes. A new release is a new URL, so the hash never goes stale. |
| Rolling | js.stripe.com/v3/, tag managers, icon kits |
No — add to bypass. The vendor updates the file behind the same URL whenever they like. |
Your own scripts
Scripts served from your own hostname are covered by Safe Mode too, and this
is stronger here than with hand-written SRI. Normally the
integrity attribute lives in your HTML, so an attacker who
reaches your server can simply delete it. We add the attribute at the edge
from hashes held on our side, which means it survives a compromise of your
origin.
The trade-off is deployment friction: if you overwrite script files in place
at the same URL, each release waits for an approval. Versioned filenames
like main.a3f2b1.js produce a new URL every release and never
trigger one. If in-place overwrites are your workflow and you would rather
not approve each deploy, turn off Safe Mode covers your own
scripts and keep enforcement for third parties only.
Approvals
The Approvals tab lists files whose hash changed and are waiting on you. Approve one and the new version is trusted immediately; reject it and the previous version stays enforced while you investigate.
Turning Safe Mode off approves everything pending, so the site stops blocking at once — useful as an emergency release valve if an update catches you at a bad moment.