No server. No database. No login. No network calls at all. One index.html file, no build step. You open it in a browser, drop in some images, export, done.
So when I sat down to audit it before pushing an update, I figured this would be quick. There's barely anything to attack.
I found three things. None of them were in the rendering code, the canvas code, or anywhere I expected. They were all in the same place: the function that opens a project file.
This is an English write-up of an article I posted on Zenn, restructured a bit for a different audience.
The setup
