Choosing static was the security decision
People ask what I hardened on this site. Honestly, the hardening is a short list, because the architecture removed most of the work first.
There is no database, so there is no injection. There is no session, so there is no session fixation, no cookie flags to get wrong, no CSRF. There is no login, so there is no credential stuffing and no password reset flow — historically one of the most reliably broken parts of any application. There is no form, so there is nothing to spam. There is no third-party script, so there is no supply chain in the browser.
What is left is genuinely small:
default-src 'none'; script-src 'self'; style-src 'self'…plus never touching innerHTML in the one piece of JavaScript that echoes
what you type. That is it. That is the whole surface.
The uncomfortable version of this post: a lot of security engineering is spent defending capabilities the product never needed. Ask what you can delete before you ask what you can harden.