Security pass

src/components/professional/ContactForm.tsx

@@ -79,6 +79,14 @@ export default function ContactForm({ turnstileSiteKey }: Props) {
         'https://challenges.cloudflare.com/turnstile/v0/api.js';
       script.async = true;
       script.defer = true;
+      // No SRI `integrity` attribute here — deliberate. Cloudflare rotates the
+      // Turnstile loader contents (so a pinned hash would break the challenge
+      // on rotation), the loader itself fetches further challenge resources
+      // that SRI can't cover, and Cloudflare does not publish official SRI
+      // hashes. SRI on Turnstile is industry-standard NOT to use; the risk is
+      // mitigated by serving the site over HTTPS and by the CSP (which
+      // restricts script-src to this one Cloudflare origin). See
+      // src/middleware.ts.
       document.head.appendChild(script);
     }