Frontend and done. Edit a running app by directly manipulating the page; it persists its own state back into the file itself.
no public repo linked · 275 KB
Is it a true single-file web app?
✗ No, this is not a single-file web app. It needs 24 files from elsewhere.
– Contacts
cdn.jsdelivr.net– Contacts
region1.google-analytics.com– Contacts
websharebox.s3.amazonaws.com– Contacts
www.googletagmanager.comHow to fix it
→ Inline
hyperclay-app-dist.css — it's already your own file, it just needs to move into the HTML→ Inline
website.js — it's already your own file, it just needs to move into the HTML→ Inline
datastar.js — it's already your own file, it just needs to move into the HTML→ Drop the analytics beacon (
www.googletagmanager.com) — it reports every visitor to a third party→ Inline
maze.js — it's already your own file, it just needs to move into the HTML→ Inline
lottie.min.js — it's already your own file, it just needs to move into the HTML→ Inline
anime.min.js — it's already your own file, it just needs to move into the HTML→ Inline
hyperclay.js into a <script>/<style> tag instead of fetching it from cdn.jsdelivr.netShow full list (24)
→ Inline
exportToWindow.js into a <script>/<style> tag instead of fetching it from cdn.jsdelivr.net→ Inline
toast.js into a <script>/<style> tag instead of fetching it from cdn.jsdelivr.net→ Inline
cookie.js into a <script>/<style> tag instead of fetching it from cdn.jsdelivr.net→ Inline
theModal.js into a <script>/<style> tag instead of fetching it from cdn.jsdelivr.net→ Inline
prompts.js into a <script>/<style> tag instead of fetching it from cdn.jsdelivr.net→ Inline
onDomReady.js into a <script>/<style> tag instead of fetching it from cdn.jsdelivr.net→ Inline
copy-to-clipboard.js into a <script>/<style> tag instead of fetching it from cdn.jsdelivr.net→ Inline
home.js — it's already your own file, it just needs to move into the HTML→ Drop the analytics beacon (
region1.google-analytics.com) — it reports every visitor to a third party→ Inline
bigpicture-esm.js — it's already your own file, it just needs to move into the HTML→ Inline
toggle-thing%20(2).json from websharebox.s3.amazonaws.com so it ships with the app→ Inline
yes-1.json from websharebox.s3.amazonaws.com so it ships with the app→ Inline
newsletter-form.js — it's already your own file, it just needs to move into the HTML→ Inline
toast.js — it's already your own file, it just needs to move into the HTML→ Inline
BerkeleyMonoVariable-Regular.woff2 — it's already your own file, it just needs to move into the HTML→ Inline
fixedsys-webfont.woff2 — it's already your own file, it just needs to move into the HTMLSecurity audit — full results 6/9
– No leaked credentials (detect-secrets) — no repo set — nothing to clone
– Semgrep security-audit ruleset — no repo set — nothing to clone
– Semgrep javascript ruleset — no repo set — nothing to clone
✓ eval() usage
✓ Function() construction
✓ decode→eval chain
✓ document.write of decoded content
✓ sendBeacon usage
✓ decoded content DOM injection
Embed this badge
