This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung →
Libraries with no maker maintenance: the only severe finding
If a frontend library whose maker has stopped maintaining it gets embedded, that's the most severe finding in this audit area — it carries 40 of the 100 points. The reason is simple: an unmaintained library will get no more fixes, no matter what gets found.
- The finding relies on a documented maker statement about end of maintenance, not a guess. It's the only case in this audit area where the finding is classified as severe.
- What the finding does NOT say: that the embedded version is vulnerable. Whether a hole exists can't be established by passive observation from outside — that would need a security scan, which this service explicitly does not perform.
- Typically affected are old helper libraries that were embedded once for a single effect, and have kept running ever since. The way out usually leads through replacing them with the browser's built-in capabilities.
FAQ
Does "end of maintenance" automatically mean "insecure"?
No. It means there will be no more fixes. That's a verifiable fact about the maker, not a statement about your installation's condition.
Why does this point weigh so much more than the others?
Because it describes the only real problem. The other three rules concern visible version values — they make identification easier, but aren't a shortcoming themselves.
Do you also check server-side libraries?
No. Only the files loaded in the browser are visible from outside. What runs on the server can't be established passively — and we don't guess.