[MEDIUM] No SRI hashes for CDN scripts - Supply Chain Attack Risk

[saidai-bhuvanesh]

🔗 Security: Missing Subresource Integrity (SRI) Hashes

Severity: Medium
Files: projects/*/index.html

Problem

External CDN scripts loaded without integrity hashes:

<!-- markdown-notes-sync/index.html -->
<script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>

Risk

If jsdelivr is compromised or a malicious version is uploaded, all users execute malicious code.

Fix

<script 
  src="https://cdn.jsdelivr.net/npm/marked/marked.min.js" 
  integrity="sha256-XrRj5aRLLKl45+4aGqh9cR6ZBwS7TRb3I4AP1cX1c=" 
  crossorigin="anonymous"
></script>

Labels: security, ssoc26

[github-actions]

Thank you for raising this issue! We'll look into it as soon as possible. Please ensure that the issue is not a duplicate, and read CONTRIBUTING.md carefully before contributing. Your contributions are highly appreciated! 😊

[saidai-bhuvanesh]

/assign

[MistryVishwa]

@saidai-bhuvanesh Assigned. You can start working on this.