ImgType/index.html at main · TechLuddite/ImgType · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
<!doctype html>
<html lang="en">
  <head>
    <meta charset="UTF-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>ImgType — Convert Images Without Uploading Them</title>
    <meta
      name="description"
      content="Free image converter that runs entirely in your browser. Convert HEIC, PNG, JPG, WebP, GIF, BMP, ICO and SVG without uploading your photos to a server."
    />
    <meta name="theme-color" content="#0a0a0a" />

    <!--
      This is the enforcement behind the privacy claim, not a restatement of it.
      `connect-src` is the directive that matters: the browser will refuse to
      send an XHR, fetch or beacon anywhere except this origin and the two
      GitHub hosts used by the opt-in source verification. Even if a dependency
      tried to upload your images, it could not.

      `unsafe-inline` on style-src is required because React writes inline
      styles; styles cannot exfiltrate data the way a connection can.
      `wasm-unsafe-eval` is required by the HEIC and AVIF WebAssembly codecs.

      `frame-ancestors` is deliberately absent: browsers ignore it in a meta
      tag, and GitHub Pages cannot set response headers, so listing it here
      would only produce a console warning and a false sense of coverage.
    -->
    <meta
      http-equiv="Content-Security-Policy"
      content="default-src 'self';
               script-src 'self' 'wasm-unsafe-eval';
               style-src 'self' 'unsafe-inline';
               img-src 'self' blob: data:;
               font-src 'self' data:;
               connect-src 'self' blob: data: https://api.github.com https://raw.githubusercontent.com;
               worker-src 'self' blob:;
               object-src 'none';
               base-uri 'none';
               form-action 'none'"
    />

    <meta property="og:type" content="website" />
    <meta property="og:title" content="ImgType — Convert Images Without Uploading Them" />
    <meta
      property="og:description"
      content="Free image converter that runs entirely in your browser. Your photos never leave the tab."
    />
    <meta name="twitter:card" content="summary" />

    <link
      rel="icon"
      href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='7' fill='%2310b981'/%3E%3Cpath d='M7 21.5l5.2-6 3.4 4 3.1-3.6 6.3 5.6z' fill='%230a0a0a'/%3E%3Ccircle cx='11.5' cy='11' r='2.4' fill='%230a0a0a'/%3E%3C/svg%3E"
    />
  </head>
  <body>
    <div id="root"></div>
    <script type="module" src="/src/main.tsx"></script>
  </body>
</html>