SEC-041
Script loaded from a hijacked CDN
CriticalDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
Script and stylesheet hosts against domains known to have served malware (polyfill.io and its sister CDNs).
Why it matters
The domain’s new owner serves malicious JavaScript to your visitors: redirects to scam sites, injected ads or worse.
Recommended fix
Remove the script, or switch to a trusted mirror (Cloudflare and Fastly host safe copies of polyfill.io).
How to verify
View the page source and confirm none of the listed hosts appear.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-041: Script loaded from a hijacked CDN
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Remove every reference to the hijacked script host in the evidence. If a polyfill is still needed, use https://cdnjs.cloudflare.com/polyfill/ or bundle the polyfills locally.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: View the page source and confirm none of the listed hosts appear.