That particular site: the code is properly formatted with comments, there's a link to a GitLab repo with the source, you could check your network traffic while

That particular site: the code is properly formatted with comments, there's a link to a GitLab repo with the source, you could check your network traffic while using it, ... But in general: I suppose what we need is a flexibly configurable JavaScript engine that stops and asks permission before any suspicious operation is performed. I don't know enough about JavaScript to know whether or how that might work. I note that the way tujavortaro.net downloads a dictionary is by adding a <script> element to the head of the document (https://gitlab.com/sstangl/tuja-vortaro/-/blob/master/app.js#L98 https://gitlab.com/sstangl/tuja-vortaro/-/blob/master/app.js...). HTML+JS is naturally self-modifying, so it's hard to do a static analysis.