✓ Yes, the entire app sits in one file. No imports, no server calls, no build.
✓ No leaked credentials (detect-secrets)
✓ Semgrep security-audit ruleset
✗ Semgrep javascript ruleset — 7 finding(s)
✗ eval() usage — eval() call found — needs manual review
✗ Function() construction — new Function() call found — needs manual review
✓ decode→eval chain
✓ document.write of decoded content
✓ sendBeacon usage
✓ decoded content DOM injection
✓ Ships an HTML file
✗ No build step required — package.json is present and no HTML file over 3 KB is committed — this looks like it needs `npm run build` before it's usable; consider committing the built output directly
✓ No backend required
✓ Submitted URL looks like the app itself