Security
No site is “100% secure” and we will never say so. The goal here is to drastically shrink the attack surface: the site does very little.
Concrete choices
- Fully static site: no backend, no database, no login.
- No third-party runtime dependencies: no CDN, no external libraries, minimal supply-chain risk.
- No secrets in the code: apart from the PayPal username, which is public by definition, there are no tokens, API keys or passwords.
- Restrictive Content Security Policy, no inline scripts or styles, no eval.
- User input is never inserted as HTML: only textContent is used.
- The payment destination is PayPal's official origin, hardcoded: the user cannot change it.
- Clickjacking protection with frame-ancestors 'none' and X-Frame-Options: DENY.
- External links use rel="noopener noreferrer".
Found a problem?
Security reports are welcome via the issues of the source code repository. No bug bounty: it is still a site that funds nothing.