# Support Subresource Integrity (SRI)

**URL:** <https://community.hubspot.com/t/support-subresource-integrity-sri/141812>\
**Category:** HubSpot Ideas\
**Tags:** snippets\
**Created:** [October 30, 2025, 1:31pm UTC](https://community.hubspot.com/t/support-subresource-integrity-sri/141812 "2025-10-30T13:31:18Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![BMoles1](https://avatars.discourse-cdn.com/v4/letter/b/dfb087/32.png) [@BMoles1](https://community.hubspot.com/u/BMoles1)\
**Post date:** [October 30, 2025, 1:31pm UTC](https://community.hubspot.com/t/support-subresource-integrity-sri/141812/1 "2025-10-30T13:31:18Z")

</div>

Please implement support for Subresource integrity validation ([https://developer.mozilla.org/en-US/docs/Web/Security/Subresource\_Integrity](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity))

Reason 1 to implement this security measure:  
When a resource is referenced on the HTML code with a different domain from which the same HTML was loaded, then a malicious actor could interfere in the DNS resolution on the end user’s machine, to make the resource be downloaded from a different location. Thus, a resource referenced with “[https://js.hs-scripts.com/\*\*\*.js](https://js.hs-scripts.com/***.js)” could be downloaded from a malicious server with malicious code. This type of attack can be prevented if HubSpot adds a verification string that allows the browser to confirm that the received asset is the expected one, without alterations.

Reason 2 to implement this security measure:  
Even if there is no attack from a malicious actor. Security audits rise this security flaw as a vulnerability, causing reputational damage to the people maintaning the website and to the website’s owner.

Please provide a solution to this.

---

<div class="post-metadata">

**Author:** ![cognidox\_vittal](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/cognidox_vittal/32/78471_2.png) [@cognidox\_vittal](https://community.hubspot.com/u/cognidox_vittal)\
**Post date:** [November 4, 2025, 11:25am UTC](https://community.hubspot.com/t/support-subresource-integrity-sri/141812/2 "2025-11-04T11:25:27Z")

</div>

I’ll upvote this as lack of SRI support can significantly negatively impact a company’s percieved security rating (e.g. when using tools such as SecurityScorecard).

---

<div class="post-metadata">

**Author:** ![TMaughan](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/tmaughan/32/202882_2.png) [@TMaughan](https://community.hubspot.com/u/TMaughan)\
**Post date:** [November 7, 2025, 3:24pm UTC](https://community.hubspot.com/t/support-subresource-integrity-sri/141812/3 "2025-11-07T15:24:53Z")

</div>

Another upvote here. This has been highlighted by our infrastructure team as a vulnerability.

---

<div class="post-metadata">

**Author:** ![saran-bm](https://avatars.discourse-cdn.com/v4/letter/s/ac91a4/32.png) [@saran-bm](https://community.hubspot.com/u/saran-bm)\
**Post date:** [November 25, 2025, 1:07pm UTC](https://community.hubspot.com/t/support-subresource-integrity-sri/141812/4 "2025-11-25T13:07:06Z")

</div>

I would definitely upvote this This has been highly recommended by our Infra team.

---

<div class="post-metadata">

**Author:** ![FBalderas3](https://avatars.discourse-cdn.com/v4/letter/f/58f4c7/32.png) [@FBalderas3](https://community.hubspot.com/u/FBalderas3)\
**Post date:** [November 26, 2025, 8:51pm UTC](https://community.hubspot.com/t/support-subresource-integrity-sri/141812/5 "2025-11-26T20:51:27Z")

</div>

Fully in favor of this. Implementing Subresource Integrity (SRI) would greatly enhance the integrity and security of website resources.

---

<div class="post-metadata">

**Author:** ![NEigsti](https://avatars.discourse-cdn.com/v4/letter/n/90db22/32.png) [@NEigsti](https://community.hubspot.com/u/NEigsti)\
**Post date:** [March 31, 2026, 3:14pm UTC](https://community.hubspot.com/t/support-subresource-integrity-sri/141812/6 "2026-03-31T15:14:54Z")

</div>

SecurityScorecard is flagging this finding for our vanity URL for Hubspot

---

<div class="post-metadata">

**Author:** ![MichelZCF](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/michelzcf/32/188651_2.png) [@MichelZCF](https://community.hubspot.com/u/MichelZCF)\
**Post date:** [July 13, 2026, 3:33pm UTC](https://community.hubspot.com/t/support-subresource-integrity-sri/141812/7 "2026-07-13T15:33:21Z")

</div>

Same here. SecurityScorecard is deducting points for this… please implement this