The main site ships a strict Content Security Policy, byte budgets in CI and no third-party scripts. This is where those rules are switched off on purpose: each experiment is one folder, runs entirely in your browser, and sends nothing anywhere.
The point-cloud that morphs on the home page — with sliders instead of a scrollbar.
Register a passkey and sign in with it, then read every byte the authenticator sent back: CBOR, COSE key, flags, counter, and the signature verified with WebCrypto.
Paste HTML, get the exact 'sha256-…' for every inline script, style and event handler, hashed over the source text the way the browser does it, plus the policy lines.