No backend, no database, no network calls. I still found 3 security holes.

No server. No database. No login. No network calls at all. One index.html file, no build step. You open it in a browser, drop in some images, export, done. So when I sat down to audit it before pushin...