Controls & verification
Check what is implemented.
Each statement below says what the site does and how you can verify it with your browser’s developer tools.
Local assets only
The game and these pages load only files from this site: scripts, styles, fonts and images. No CDN, framework download, analytics or third-party resource.
To verify: reload any page with the Network panel open. Every request uses the same origin.
Scripts
The game at the home page uses JavaScript: React and the simulation engine, bundled locally. The presentation pages (About, Security, Sources, Contact, Legal) use none, and their policy forbids scripts entirely.
To verify: disable JavaScript and open a presentation page; its content and navigation remain available.
No visitor collection
No cookies, no browser storage, no forms and no tracking. The game keeps its state in memory: reloading the page starts a new mission. It makes no network request after loading.
To verify: inspect the Storage or Application panel and the Network panel during a mission. Hosting access logs are a separate matter, described on the legal page.
Restrictive browser policy
A Content Security Policy starting with default-src 'none' allows only the site’s own resources, forbids inline scripts and styles, blocks network connections from scripts and requires Trusted Types where supported.
Other headers disallow framing, prevent MIME-type sniffing, suppress referrer information, disable browser capabilities through Permissions-Policy and set HSTS without preload.
Limits of these measures
These controls reduce what the site can do in your browser. They are not a guarantee against every vulnerability. To report a security issue, see the contact page.