Where the attack surface of a pure front-end tool really is
"No uploads, no backend, therefore secure" is only half true. Removing the server does eliminate a large part of the attack surface, but the risk moves to two places: the visitor's browser and the dependency chain.
