It's hosted on Github Pages which is just static file serving. And thanks to CORS restrictions I don't think you could phone home.
Unless there's a workaround I'm not thinking of.
Unless there's a workaround I'm not thinking of.
They also don’t set a CSP header, which opens up the opportunity to exfiltrate data by other means, e.g having the browser load an image on your.site/$password.jpg.