This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung →
Libraries with no maker maintenance: the only severe finding
If a frontend library whose maker has stopped maintaining it gets embedded, that's the most severe finding in this audit area — it carries 40 of the 100 points. The reason is simple: an unmaintained library will get no more fixes, no matter what gets found.
- The finding relies on a documented maker statement about end of maintenance, not a guess. It's the only case in this audit area where the finding is classified as severe.
- What the finding does NOT say: that the embedded version is vulnerable. Whether a hole exists can't be established by passive observation from outside — that would need a security scan, which this service explicitly does not perform.
- Typically affected are old helper libraries that were embedded once for a single effect, and have kept running ever since. The way out usually leads through replacing them with the browser's built-in capabilities.
