No server. No database. No login. No network calls at all. One index.html file, no build step. You open it in a browser, drop in some images, export, done.

So when I sat down to audit it before pushing an update, I figured this would be quick. There's barely anything to attack.

I found three things. None of them were in the rendering code, the...