by pushme-pullyou
Browse any GitHub repo in your browser, zero install, one HTML file.
HTML 98% · JavaScript 1.6% · CSS 0.3% · PowerShell 0.1%
Is it a true single-file web app?
✗ No, this is not a single-file web app. It needs 14 files from elsewhere.
– Contacts
api.github.com– Contacts
cdn.jsdelivr.net– Contacts
cdnjs.cloudflare.com– Contacts
fonts.googleapis.com– Contacts
fonts.gstatic.com– Contacts
img.shields.io– Contacts
raw.githubusercontent.comHow to fix it
→ Inline
marked.min.js into a <script>/<style> tag instead of fetching it from cdn.jsdelivr.net→ Inline
github.min.css into a <script>/<style> tag instead of fetching it from cdnjs.cloudflare.com→ Inline
highlight.min.js into a <script>/<style> tag instead of fetching it from cdnjs.cloudflare.com→ Inline
purify.min.js into a <script>/<style> tag instead of fetching it from cdn.jsdelivr.net→ Inline
tootoo.config.js — it's already your own file, it just needs to move into the HTML→ Inline
tootoo from api.github.com so it ships with the app→ Inline
main from api.github.com so it ships with the app→ Inline
README.md from raw.githubusercontent.com so it ships with the appShow full list (14)
→ Inline
demo-live-success from img.shields.io so it ships with the app→ Inline
license-MIT-blue from img.shields.io so it ships with the app→ Inline
single--file-vanilla%20JS-orange from img.shields.io so it ships with the app→ Inline
tootoo-screenshot.jpeg from raw.githubusercontent.com so it ships with the app→ Self-host the webfont as a base64
@font-face, or fall back to a system font stack (currently fonts.googleapis.com)→ Self-host the webfont as a base64
@font-face, or fall back to a system font stack (currently fonts.gstatic.com)Security audit — full results 13/13
✓ No leaked credentials (detect-secrets)
✓ Semgrep security-audit ruleset
✓ Semgrep javascript ruleset
✓ eval() usage
✓ Function() construction
✓ decode→eval chain
✓ document.write of decoded content
✓ sendBeacon usage
✓ decoded content DOM injection
✓ Ships an HTML file
✓ No build step required
✓ No backend required
✓ Submitted URL looks like the app itself
Embed this badge
