Group
  • Security

    Audit my third-party scripts and CDN assets

    Inventories every external script, pins versions, adds integrity hashes where possible, and removes what's unused.

    • Improve quality
    • Plan & validate
    • Beginner
    • Replit
    • Cursor
    • Bolt
    • Lovable
    • General

Free Prompt

Inventory every third-party script, stylesheet, font, and iframe loaded by my app. Check HTML templates, layout files, and any code that injects external resources. For each one: confirm it's actually still used (remove anything dead; AI builders frequently leave behind scripts from abandoned features); load it over HTTPS only; where the CDN supports it, add Subresource Integrity hashes and crossorigin attributes so a compromised CDN can't inject malicious code; pin to a specific version instead of "latest" URLs; and for anything that must stay un-pinned (analytics, chat widgets), note it as a deliberate exception. Check iframes for sandbox attributes where full trust isn't needed. Do not remove scripts that are load-bearing (payments, auth widgets, error tracking). If something looks unused, tell me what it does before removing it so I can confirm. Keep the CSP work consistent with whatever Content-Security-Policy my app has. Deliver a table: resource, purpose, keep or remove, and the hardening applied. Flag anything loaded from an obscure or unmaintained CDN as a candidate to self-host or replace.

What This Does / How This Helps

Inventories every external script your pages load, removes the leftovers, and pins or integrity-checks the rest. Every third-party script runs with full access to your page: the DOM, cookies (non-HttpOnly ones), form fields, everything your users type. A compromised or abandoned CDN is a supply-chain attack delivered through your own site, and AI builders accumulate stray scripts fast because each feature attempt tends to add one. You get a keep-or-remove decision for each resource and SRI hashes where supported, so a CDN breach can't rewrite your checkout page.

Want to skip doing this by hand?

Fortivibe audits your app for all of the areas these prompts cover (and more).

See What We Check

Related Prompts