Most of a Framer site is not code. The parts that are, are code components, and that is where the risk collects. A component that calls an API needs a key. A component that needs a library sometimes imports it from a URL. A component rendering content from elsewhere has to decide how much it trusts that content. I built a free plugin that reads them and reports what it finds. Here is what it looks for, and the parts that were harder than expected. First, the thing that caught me o...