Security

Last updated November 14, 2026

What this site knows about you

• No accounts, cookies, analytics, ads or tracking.
• Every file the site uses is served from this site. Fonts and thumbnails included, so your browser doesn't call Google or YouTube just to show a page.
• Your arcade scores are saved in your own browser (localStorage). They never leave your device. Clearing site data wipes them.
• Clipstack edits your video inside your browser. Your clip is never uploaded.
• Links to YouTube, Instagram, Facebook and TikTok are plain links. Nothing from those sites is embedded.

Security rules the site sends

• Content-Security-Policy: the browser may only run scripts, styles, fonts and images from this site, and may not contact any other server. Clipstack also allows WebAssembly and in-browser workers, which its audio encoder needs.
• frame-ancestors and X-Frame-Options: other sites can't put these pages in a frame to trick you into clicking. Only the arcade may frame its own games.
• Game score checks: the arcade only accepts a score if it comes from this site, from the game frame on screen, and names that game.
• X-Content-Type-Options: nosniff: files are only treated as the type they're served as.
• Referrer-Policy: no-referrer: links you follow don't tell the next site where you came from.
• Permissions-Policy: camera, microphone, location, USB and payments are switched off.
• Strict-Transport-Security: browsers only ever load this site over HTTPS.

How the clips get here

Once a day a GitHub Action asks the YouTube Data API for the newest Shorts on both channels, saves the thumbnails into this site, and redeploys. The API key lives in a GitHub secret and never reaches your browser.

Open source

All of it is public on GitHub: the hub, Clipstack, and the games Light Snake, Bullseye and Turtle Surf. Clipstack's own details are on its security page.

Report a problem

Found a security issue? Please report it privately on GitHub instead of opening a public issue. The contact is also in security.txt.