✓ Yes, the entire app sits in one file. No imports, no server calls, no build.
✓ No leaked credentials (detect-secrets)
✓ Semgrep security-audit ruleset
✓ Semgrep javascript ruleset
✓ eval() usage
✓ Function() construction
✓ decode→eval chain
✓ document.write of decoded content
✓ sendBeacon usage
✓ decoded content DOM injection
✓ Ships an HTML file
✓ No build step required
✓ No backend required
✓ Submitted URL looks like the app itself