What “browser-only” means

Film Stack Simulator has no application back end, account service, telemetry endpoint, or cloud-save API. Cloudflare Pages serves static files. The browser performs the geometry calculations and stores saved stacks locally. Export creates a local download initiated by the user.

The guarantee applies to the simulator at /: after its same-origin static files load, running a flow, saving locally, and exporting must not create another network request. A manually submitted newsletter form may exist on case-study pages only when its owner has configured an action; it is never included in the simulator.

Runtime dependencies

The list below is generated at build time from the dependencies object in package.json; it is not a hand-maintained marketing list.

  • @fontsource-variable/ibm-plex-sans ^5.3.0Self-hosted IBM Plex Sans font asset
  • pako ^3.0.1Local URL-state compression and decompression
  • react ^19.2.8Simulator user-interface rendering
  • react-dom ^19.2.8React browser DOM integration
  • three ^0.185.1Client-side 3D presentation

Build and test tools under devDependencies do not ship as browser runtime dependencies. The IBM Plex Sans font file used by these static pages is copied from the declared Fontsource package and served from this site's own origin.

Verify it yourself in DevTools

  1. Open the simulator at / in a private window with browser extensions disabled.
  2. Open Developer Tools, choose Network, enable Preserve log, and enable Disable cache while DevTools is open.
  3. Reload the page, then open the 3D view once so its lazily loaded JavaScript and worker are fetched. Initial HTML, JavaScript, CSS, worker, and font requests should all have the site's own origin. Inspect the document response headers too: Speculation-Rules must be absent.
  4. Clear the Network list without reloading. Run a complete flow, change parameters, save it locally, switch between the now-loaded views, and export JSON.
  5. The list should remain empty. If it does not, inspect the Domain, Initiator, and request URL. A browser extension is not site code, but any request initiated by the simulator is a failed zero-egress check.
  6. Repeat against the deployed production URL because an edge platform can modify HTML after the repository build.

The repository can be inspected independently: open the configured source repository

Cloudflare features that must stay off

Cloudflare can inject or rewrite client resources after deployment. Keep all of the following disabled for the simulator hostname, then repeat the production Network test:

Ordinary Cloudflare caching and transport compression do not add browser destinations. The interlock is observable behavior: if a platform setting, dependency, or future feature causes a new request, disable it or remove the zero-egress claim before release.