`. It suggests the app's address. 8. Other sites cannot show the app in an iframe. It opens through its own link.

I will publish this app on vibed.host, a host for static web apps with strict security rules. Please follow them: 1. Give me one complete `index.html` with all CSS and JavaScript inside. No build step. 2. Scripts, stylesheets and fonts from other sites load only from `https://cdn.jsdelivr.net` and `https://cdnjs.cloudflare.com`. Everything else from other sites is blocked: - No Google Fonts. Load the same font from Fontsource instead: `` (font name in lowercase with hyphens; `index.css` is weight 400, other weights as `700.css`). Or use a system font stack. - No images from other sites. Use inline SVG, emoji, CSS or `data:` URLs. - No calls to APIs, unless listed as in rule 6. 3. No API keys, passwords or tokens in the code. Everything in the app is public. 4. There is no server and no shared database yet. Store data in `localStorage`; every visitor sees only their own. 5. Show user input with `textContent`, never with `innerHTML`. 6. Only if the app must call an external API: add this to ``, with the API's origin and a name for the app (3–32 lowercase letters, digits and hyphens; it becomes `.vibed.host`): `` 7. Set a short, meaningful ``. It suggests the app's address. 8. Other sites cannot show the app in an iframe. It opens through its own link.