Comment by sirl1on

You can define a CSP header to only exec 3rd Party scripts with known hashes