This is a static, zero-dependency, client-side-only project. The attack surface is intentionally minimal:

• No backend, no server, no database
• No npm / pip dependencies
• No external API calls (except Google Fonts CDN, which is loaded via standard <link> tags)
• No user input is sent anywhere
• No cookies, no tracking, no analytics

• XSS via content: All text content is in js/i18n.js (server-rendered by static hosting). If you fork this project and accept user-submitted text, sanitize before injecting. Default config: no user input.

• Copyright / DMCA: If you find that this repository contains copyrighted material that should not be redistributed, see NOTICE file for our 48-hour takedown policy.

• Dependency confusion: None possible. This project has no dependencies.

Open a GitHub Issue with the label security. We will respond within 48 hours.

For sensitive disclosures, you can also open a private security advisory via GitHub's Security tab → "Report a vulnerability".

这是一个静态、零依赖、纯客户端项目。攻击面被刻意压缩到最小：

• 无后端，无服务器，无数据库
• 无 npm / pip 依赖
• 无外部 API 调用（除 Google Fonts CDN）
• 用户输入不发往任何地方
• 无 cookie、无追踪、无分析

• XSS via content: 所有文字内容在 js/i18n.js（静态托管服务端渲染）。如果你 fork 本项目并接受用户提交文字，注入前请消毒。默认配置：无用户输入。
• 版权 / DMCA: 如果你认为本仓库包含不应再分发的版权内容，参见 NOTICE 文件的 48 小时下架政策。
• 依赖混淆: 不可能。本项目无依赖。

• 在 GitHub 开 Issue 标签 security，48 小时内响应。
• 敏感披露：用 GitHub Security tab → "Report a vulnerability"。