External scripts load without Subresource Integrity protection

Subresource Integrity (SRI) is a browser feature that lets a site specify a cryptographic fingerprint for an external script or stylesheet it loads, so the browser can verify the file hasn't been tampered with before running it. This check looks for external scripts and stylesheets loaded without this protection. On this site, external resources were found loading without SRI hashes. Without SRI, if the external service hosting one of these scripts, such as a CDN, content delivery network, is ever compromised, the malicious replacement code runs on this site with full trust, as if it were the site's own code, because there's nothing checking it hasn't changed. This is sometimes called a supply-chain attack, and it can lead directly to arbitrary code execution under the site's own domain. Your developer should add integrity and crossorigin attributes to every external script and stylesheet link tag on the site. Most CDNs, including the popular ones, publish the correct integrity hash alongside the script URL they provide, so this is largely a matter of copying the right values in rather than generating them manually.