Source ReviewPASS
The two files we wrote, quickstart-ui/index.html and quickstart-ui/nginx.conf, were read line by line: pattern matching for eval and new Function found nothing; the page has no script, link, img or @import pointing at an external host, and its styles and JavaScript are inlined in the same file; only one outbound network call was found, and it goes to the same-origin /pdf/ proxy. nginx.conf only serves static files plus one reverse-proxy block, and proxy_pass points at the service name pdf-engine inside compose. What runs on the buyer's machine is the official image published upstream rather than a build from this snapshot, and the upstream Go source was not read file by file; in compose the engine exposes no port to the host and is reached only through the ui proxy.