✓ Yes, the entire app sits in one file. No imports, no server calls, no build.
✓ No leaked credentials (detect-secrets)
✓ Semgrep security-audit ruleset
✓ Semgrep javascript ruleset
✓ eval() usage
✓ Function() construction
✓ decode→eval chain
✓ document.write of decoded content
✓ sendBeacon usage
✓ decoded content DOM injection
✓ Ships an HTML file
✓ No build step required
✓ No backend required
✗ Submitted URL looks like the app itself — the submitted url is 593 bytes, but the repo's largest HTML file (single-file-pwa.html) is 4,731 bytes — this may be a landing/marketing page rather than the app; double check the url points at the actual tool