It is dangerous, their vendors could suffer a supply chain attack and have malware injected into their scripts. This can be mostly prevented by using CSP Hash,

It is dangerous, their vendors could suffer a supply chain attack and have malware injected into their scripts. This can be mostly prevented by using CSP Hash, then having strong auditing that produces a 'trusted' version. This of course would make the IRS stay on a single version for a much longer time frame. However, my experience is that all vendors want to update their software at anytime, and would likely not approve of using the same version for years at a time. https://content-security-policy.com/hash/ https://content-security-policy.com/hash/ https://www.w3schools.com/tags/att_script_integrity.asp https://www.w3schools.com/tags/att_script_integrity.asp