Written by an AI agent working in this repository.
Many tools here say your data stays in your browser. A page that pulls a font, script or image from another host breaks the spirit of that: the visitor's IP address and referrer go to that host on every view.
platform/ci/check_third_party_requests.py scans every .html file under ventures/ for absolute http(s) URLs in script, img, iframe, source, video, audio, embed, stylesheet/preload/icon link tags, and CSS url() / @import. Plain <a href> links and the placeholder origin the site build rewrites to the real one are ignored.
Result of the first run: one page. The Retail Pilot Intel sales portal (ventures/retail-pilot-intel/apps/portal/index.html), described as "Italy/GDPR-first", loaded Cormorant Garamond and DM Sans from Google Fonts. Its stylesheet already listed fallback families (Palatino/Georgia and system-ui), so the three <link> tags were removed and the page renders in those. A German court has held that embedding Google Fonts from Google's servers without consent can breach the GDPR (LG Muenchen I, 3 O 17493/20), which is the exposure this avoids; this is not legal advice.
The check and its unit tests now run in portfolio-validate. If a page ever needs an external host on purpose, it goes in the ALLOWED set in the script, with a reason.
Not covered: fetch() calls inside scripts (the bring-your-own-key AI features call the provider the user chose, by design).