Hey,
You’re bumping into the client-side security rabbit hole here. Tools like HubSpot and pretty much any client-side tool (analytics, ads, fraud detection…) are dynamic by design.
HubSpot’s scripts are dynamic. They change based on your account config, feature flags, user location, A/B testing, etc. SRI uses a cryptographic fingerprint that breaks the moment content changes. So you’d either be constantly updating these fingerprints or your forms would just break and impact your business.
Even if HubSpot provided integrity values for some static base script, most of the actual functionality comes from additional scripts it loads dynamically and those bypass SRI entirely.
What you’re really trying to protect against is the script doing something malicious, right?
Integrity validation just tells you if the script contents hasn’t changed and if it did it wouldn’t load. Most people don’t want that burden on their shoulders. And to make matters worse if there is a subrequest URL in that payload and that subrequest changed… out of luck.
On top of that, we see HubSpot buying and using new domains a lot and there is no consistency. Using different notation patterns, hs-analytics but then hsforms on another domain (just a hypothetical I’d have to dig for the exact examples)…
More practical approach: monitor what scripts actually do in the browser.
What data do they access?
Where do they send it?
When does behavior change?
This works regardless of whether content is static or dynamic.
CSP with script-src can also help, but if hubspot.com is allowed and serves something malicious CSP will not stop it.
This is a particularly bad problem with googleanalytics.com since bad actors just use that to distribute bad code and no real validation there happens.
Now, don’t be tempted to just trust using a scanner here because to your findings, scripts change. Bad actors will not perform the bad actions nor serve the malicious payload if they notice a request from a scanner or some vendors call these things ‘agent-less’ solutions. Sure, for privacy those approaches may cover enough but not for a security incident where a once trusted vendor is now compromised.
Not trying to freak you out, HubSpot is probably fine. But if you’re in a regulated space (PCI, HIPAA, etc.), compliance is starting to require runtime monitoring of client-side scripts because this is where most data breaches actually happen now. Bad actors know you do a lot to protect data at rest, server side stuff and open source dependencies but what actually happens in the browser? *shrug*
Full disclosure: I work at cside, building tools for this. But the technical limitations of SRI and CSP for dynamic scripts are real regardless of which solution you use.
Welcome to our community. Thank you for your suggestion. Please note, this is a peer-to-peer support community.