– No. It's a single-file app, but it needs PHP to run, so it can't open straight from disk in a browser.
✓ No leaked credentials (detect-secrets)
✓ Semgrep security-audit ruleset
✓ Semgrep javascript ruleset
✓ eval() usage
✓ Function() construction
✓ decode→eval chain
✓ document.write of decoded content
✓ sendBeacon usage
✓ decoded content DOM injection
✗ Ships an HTML file — no .html/.htm file found in the repo — nothing here is directly usable in a browser
✓ No build step required
✗ No backend required — primary language is PHP — this catalog is for apps with no server to keep alive; confirm this genuinely runs client-side only before merging
✓ Submitted URL looks like the app itself