Consider privacy implications of third-party embed.

Loading a third-party service (Termly) on your privacy policy page may result in user tracking or data collection by Termly. Ensure this is compliant with your privacy policy and consider whether visitors should be notified.

You may want to review Termly's privacy practices:

🌐 Web query:

What data does Termly collect from embed-policy.min.js visitors?

💡 Result:

Short answer — Termly's embed-policy.min.js (the script used to embed Termly-hosted policies) collects minimal visitor and device/usage data needed to render and log consent. According to Termly's docs and privacy info this includes things like:

• consent logs and cookie preferences (what the visitor accepted/declined). [1][2]
• technical/browser/device identifiers: IP address, browser and device characteristics, OS, language, user-agent. [1][3]
• request/usage metadata: referring URL, timestamps, pages visited and other basic log/usage data. [1][3]
  Termly also says it minimizes/anonymizes visitor data and offers an EU-only data storage option for consents. [1][2]

Sources: Termly support & privacy pages summarizing “visitor data” and embed usage. [1][2][3]

---

🏁 Script executed:

```shell
#!/bin/bash
# Check the full privacy-policy.astro file for any disclosure about Termly or third-party tracking
cat src/pages/privacy-policy.astro | head -80

Length of output: 812

Add Subresource Integrity (SRI) for external script.

Loading the Termly SDK without Subresource Integrity verification creates a security risk. If the external domain is compromised, malicious code could be injected into your privacy policy page.

Consider adding SRI attributes. First, check Termly's documentation for their recommended implementation:

If SRI is not available from Termly, consider these alternatives:

1. Host the Termly script on your own CDN with SRI
2. Implement a Content Security Policy (CSP) to restrict script sources
3. Contact Termly support to request SRI support

Additionally, verify your site's CSP allows scripts from app.termly.io:

🏁 Script executed:

#!/bin/bash
# Description: Check for Content Security Policy configuration

echo "Searching for CSP configuration..."
rg -n "Content-Security-Policy" -A 5
rg -n "script-src" -A 3

Length of output: 34

🌐 Web query:

Does Termly provide Subresource Integrity hash for embed-policy.min.js?

💡 Result:

Short answer: No — Termly’s documentation and embed snippets do not provide a Subresource Integrity (integrity) hash for embed-policy.min.js. Their examples use a plain src to https://app.termly.io/embed-policy.min.js (or newer app.termly.io resource URLs) without an integrity attribute. [1][2]

If you need SRI, you can fetch the file yourself, compute the SHA256/384/512 hash, and add an integrity attribute — but note that Termly may update that hosted file (breaking the hash) unless you self-host a stable copy. [1][2]

Sources:

• Termly embed (React) example showing script src (no integrity). [1]
• Termly CMP embed script versions (lists hosted script URLs; no integrity/hash provided). [2]

I need to check for CSP configuration at the deployment/build level, as it may not be in the source code directly.

🏁 Script executed:

#!/bin/bash
# Description: Search for deployment and build configuration files

echo "Searching for deployment configuration files..."
fd -e "astro.config" -o -e "astro.config.mjs" -o -e "astro.config.ts" -o -e "netlify.toml" -o -e "vercel.json" -o -e "_headers" -o -e "_redirects" 2>/dev/null

echo ""
echo "Checking for astro integrations or middleware that might set headers..."
rg -n "setHeader|addHeader|middleware" --type ts --type js -B 2 -A 2 2>/dev/null | head -30

echo ""
echo "Looking for security-related configuration..."
rg -n "secure|security|header" --type ts --type js --type toml --type json -i 2>/dev/null | head -20

Length of output: 167