designslife/tortugotchi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security hardening: drop npm deps and self-host Outfit font

Browse Source 
- Remove package.json / package-lock.json. The only dependency was
  claude-flow (dev tooling, never loaded by the game), which pulled in
  49 known vulnerabilities (2 critical, 28 high) and could be installed
  by the Cloudflare Pages build.
- Self-host the Outfit variable font (latin + latin-ext woff2, SIL OFL)
  in fonts/ instead of loading it from Google Fonts. This removes the
  last third-party origins from the CSP (style-src / font-src are now
  'self' only), stops sending visitor IPs to Google, and makes the font
  work offline.
- Precache the font files in the service worker and bump CACHE_NAME to
  tortugotchi-v18.
This commit is contained in:
Joel Brock
2026-10-30 17:43:03 -07:00
parent fadf1ccd50
commit f85a6fb9b7
9 changed files with 121 additions and 9326 deletions
Download Patch File Download Diff File Expand all files Collapse all files
index.html
+2 -4
View File
@@ -17,10 +17,8 @@
<meta name="description" content="Help raise awareness for sea turtle conservation! Guard nests, guide hatchlings to the ocean, raise your own sea turtle, and protect it from human and environmental hazards in this interactive Tamagotchi-style game.">
<meta name="keywords" content="sea turtle, conservation, tamagotchi, game, PWA, marine life, endangered species">
<!-- Fonts -->
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Outfit:wght@400;600;800&display=swap" rel="stylesheet">
<!-- Fonts (self-hosted Outfit, declared in style.css) -->
<link rel="preload" href="fonts/outfit-latin.woff2" as="font" type="font/woff2" crossorigin>
<link rel="stylesheet" href="style.css">
</head>