- Remove package.json / package-lock.json. The only dependency was
claude-flow (dev tooling, never loaded by the game), which pulled in
49 known vulnerabilities (2 critical, 28 high) and could be installed
by the Cloudflare Pages build.
- Self-host the Outfit variable font (latin + latin-ext woff2, SIL OFL)
in fonts/ instead of loading it from Google Fonts. This removes the
last third-party origins from the CSP (style-src / font-src are now
'self' only), stops sending visitor IPs to Google, and makes the font
work offline.
- Precache the font files in the service worker and bump CACHE_NAME to
tortugotchi-v18.
Vanilla HTML/CSS/JS Tamagotchi-style game with three species
(green, loggerhead, leatherback), persistent idle progression,
hazard QTEs (sharks, boats, ghost nets, tourists), and offline
PWA support via service worker. Includes README with cited
conservation resources and research.
Joel Brock