JavaScript Zero-trust Resources