Several third-party security rating tools (e.g., SecurityScorecard) flag published Framer sites for "Unsafe Implementation of Subresource Integrity" because the scripts Framer's platform injects automatically don't include integrity/crossorigin attributes. This includes things like:

These are emitted by Framer's own publishing pipeline, so site owners have no way to add SRI attributes ourselves. The Custom Code panel only lets us inject scripts we author, not modify what Framer itself outputs.

This is becoming a real business problem, not just a cosmetic scan finding: security ratings like SecurityScorecard are increasingly used by companies during vendor/procurement due-diligence, and this specific finding has already come up as a concern from prospective customers evaluating sites built on Framer. It reflects on Framer's platform for every site built on it, so a fix here would benefit the whole customer base, not just individual sites.

A few things that would help:

Given how commonly this shows up in vendor security scans, I'd expect other Framer customers are hitting the same friction with their own customers/partners. Would appreciate this getting prioritized or at least acknowledged with a public status.

Thanks,