| Mitigation | CDN Script Compromise | Injection via Response | SSRF via Redirect | Supply Chain Data |
|---|---|---|---|---|
| MIT 01 Treat as untrusted | — Architecture | ✓ Changes mindset | ✓ Validates all URLs | ✓ Validates all fields |
| MIT 02 Validate all fields | — Not applicable | ✓ Parameterize / escape | — See MIT 03 | ✓ Strips JNDI / XSS |
| MIT 03 Allowlist outbound URLs | — Server-side only | — Not directly | ✓ Blocks redirect to internal | — Not directly |
| MIT 04 Vendor due diligence | ✓ Screens weak CDN practices | ✓ Evaluates data handling | ✓ Evaluates redirect security | ✓ Filters poor-security vendors |
| MIT 05 Subresource Integrity | ✓ Blocks tampered scripts | — Script-only | — Script-only | — Script-only |
| MIT 06 Minimum privilege | ✓ Limits blast radius | ✓ Limits blast radius | ✓ Limits blast radius | ✓ Limits blast radius |
| MIT 07 Isolate integrations | — Browser-layer attack | ✓ Adapter validates before core | ✓ Adapter handles fetches | ✓ Adapter normalizes data |
MIT 02 (validate all fields — parameterize, escape, sanitize) and MIT 03 (allowlist outbound URLs) close the highest-impact injection and SSRF vectors. MIT 05 (SRI) is the direct defense against Magecart-style CDN compromise. Together, these three address the three most common API10 attack patterns.