We do this on securesha.re. Yes, you can&#x27;t be sure the client hasn&#x27;t changed the JS - I&#x27;m going to start putting md5s in the script tags but it&#x27;s up to the client to check they haven&#x27;t changed. However, the client is open source [1], so you could always run your own client.<p>1. <a href="https:&#x2F;&#x2F;github.com&#x2F;STRML&#x2F;securesha.re-client&#x2F;" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;STRML&#x2F;securesha.re-client&#x2F;</a>