PostHog: Verify pinned SDK scripts
Component: posthog · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-06.
PostHog now enables browser SDK installations to pin a SHA-384 hash for the core script downloaded by the static loader. This security enhancement ensures that any modified script bytes are rejected instead of being silently loaded.
💻 Software Engineers & Devs
Developers should consider updating their browser SDK integrations to leverage SHA-384 hash pinning for enhanced script integrity.
📊 Product & Engineering Leads
Product managers can communicate improved security and integrity for client-side data collection through SDK script validation.
⚙️ DevOps & Security
DevOps teams have no direct CI/CD or deployment impact, but may need to manage hash values for client-side script integrity if implemented.
✨ New Features & Capabilities (2)
- SHA-384 hash pinning capability for browser SDK scripts
- Rejection of modified browser SDK script bytes
⚡ Performance & Enhancements (1)
- Enhanced security for browser SDK script loading via integrity checks