From 9ed58fb8f07dec0fe1c91ad2cb93f5d443346739 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 4 Jul 2026 11:37:51 +0000
Subject: [PATCH] security: add SRI hash to Redoc CDN script tag

The docs site loads redoc.standalone.js from jsdelivr with no integrity
check, so a compromised or MITM'd CDN response would run unmodified in
visitors' browsers. Pin it with a sha384 SRI hash (verified against
jsdelivr's published sha256 for the same file) and crossorigin="anonymous".
---
 docs/index.html | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/docs/index.html b/docs/index.html
index 66ce922..8585fd0 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -39,7 +39,11 @@
       <button id="tab-sat" data-spec="sat-openapi.yaml">SAT &mdash; Security Awareness Training</button>
     </div>
     <div id="redoc-container"></div>
-    <script src="https://cdn.jsdelivr.net/npm/redoc@2.5.3/bundles/redoc.standalone.js"></script>
+    <script
+      src="https://cdn.jsdelivr.net/npm/redoc@2.5.3/bundles/redoc.standalone.js"
+      integrity="sha384-xiEssMQFSpSfLbzRZCGfxxIM5QDb2DTrU6vyoZdp2sV1L6pmOMy6MpTtUoLbpC96"
+      crossorigin="anonymous"
+    ></script>
     <script>
       var REDOC_OPTIONS = {
         hideDownloadButton: false,