Subresource Integrity Auditor

Audit one public page for Subresource Integrity coverage on external scripts and stylesheets. The actor fetches the page HTML once, extracts script and stylesheet resources, and returns SRI readiness fields suitable for QA pipelines, security checks, and scheduled monitoring.

Use cases

• Check marketing pages before launch for third-party CDN script risk.
• Monitor CMS templates for missing SRI on scripts and stylesheets.
• Add a focused SRI gate to security and frontend QA workflows.
• Inventory third-party assets that should be pinned with integrity hashes.

Input

Field	Type	Required	Description
startUrl	string	Yes	Public page URL to audit. HTTP and HTTPS only. Private IP ranges and URL credentials are blocked.
timeoutSeconds	integer	No	Request timeout in seconds. Default: 10. Minimum: 3. Maximum: 30.
maxHtmlBytes	integer	No	Maximum HTML bytes to download and parse. Default: 1048576. Maximum: 2097152.

Output

Each run pushes one dataset item.

Field	Type	Description
inputUrl	string	URL provided as input.
finalUrl	string	Final URL after redirects.
status	integer	HTTP response status, when available.
https	boolean	Whether the final page was loaded over HTTPS.
truncated	boolean	Whether HTML parsing stopped at maxHtmlBytes.
fetchError	string or null	Fetch or validation error, when one occurred.
resourceCount	integer	Number of scripts and stylesheets checked.
thirdPartyCount	integer	Number of checked resources on a different registrable domain.
missingIntegrityCount	integer	Third-party resources missing an integrity attribute.
weakHashCount	integer	Resources using only sha256 integrity.
invalidIntegrityCount	integer	Resources with unsupported or invalid integrity token format.
missingCrossoriginCount	integer	Cross-origin resources using SRI without crossorigin.
insecureResourceCount	integer	Resources loaded over non-HTTPS URLs.
resources	array	Per-resource details: tag, URL, third-party flag, integrity status, algorithms, crossorigin, HTTPS, issues, and recommendation.
issues	array	Deduplicated issue list.
score	integer	SRI readiness score from 0 to 100.
grade	string	Letter grade: A+, A, B, C, D, E, or F.
checkedAt	string	ISO timestamp.
recommendations	array	Actionable remediation steps.

Example input

{
  "startUrl": "https://example.com",
  "timeoutSeconds": 10,
  "maxHtmlBytes": 1048576
}

Example output

{
  "inputUrl": "https://example.com",
  "finalUrl": "https://example.com/",
  "status": 200,
  "https": true,
  "truncated": false,
  "fetchError": null,
  "resourceCount": 2,
  "thirdPartyCount": 1,
  "missingIntegrityCount": 1,
  "weakHashCount": 0,
  "invalidIntegrityCount": 0,
  "missingCrossoriginCount": 0,
  "insecureResourceCount": 0,
  "resources": [
    {
      "tag": "script",
      "url": "https://cdn.example.net/app.js",
      "thirdParty": true,
      "hasIntegrity": false,
      "algorithms": [],
      "validIntegrityFormat": false,
      "weakHash": false,
      "crossorigin": null,
      "https": true,
      "issues": ["Third-party resource is missing Subresource Integrity."],
      "recommendation": "Third-party resource is missing Subresource Integrity."
    }
  ],
  "issues": ["Third-party resource is missing Subresource Integrity."],
  "score": 80,
  "grade": "B",
  "checkedAt": "2026-09-11T00:00:00.000Z",
  "recommendations": ["Add integrity hashes to third-party scripts and stylesheets that are stable enough to pin."]
}

Security

The actor accepts only public HTTP and HTTPS URLs. It rejects URL credentials, private IPv4 and IPv6 literals, and hostnames that resolve to private IP ranges. Redirect targets are revalidated before following. The actor fetches only the input page HTML and does not fetch discovered script or stylesheet URLs.

Pricing suggestion

Event	Suggested price
Actor start	$0.005
Page audited	$0.01

Suggested total for a typical run: about $0.015 per audited page.

FAQ

Does this verify the remote file hash?

No. It audits page markup for SRI posture and does not fetch discovered resources. This keeps runs fast, bounded, and safer for SSRF control.

Why are first-party resources not counted as missing SRI?

SRI is most valuable for third-party CDN resources. First-party resources are still listed, but missing integrity on same-site files is not scored as a defect.

Does it run JavaScript?

No. It reads the initial HTML response only. Browser-rendered resources are outside this actor's scope.