diff -uN pulse/index.html pulse2/index.html
--- pulse/index.html
+++ pulse2/index.html
@@ -5,9 +5,23 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Pulse</title>
     <link rel="icon" href="favicon.svg" type="image/svg+xml">
-    <link rel="preconnect" href="https://fonts.googleapis.com" referrerpolicy="no-referrer">
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin referrerpolicy="no-referrer">
-    <link href="https://fonts.googleapis.com/css2?family=Share+Tech+Mono&family=Orbitron:wght@400;500;700&display=swap" rel="stylesheet" referrerpolicy="no-referrer">
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src 'self' data: blob:; media-src 'self' blob: data:; font-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-eval'; connect-src 'self' blob: data:">
+    <link rel="preload" href="fonts/ShareTechMono-Regular.ttf" as="font" type="font/ttf" crossorigin>
+    <link rel="preload" href="fonts/Orbitron-wght.ttf" as="font" type="font/ttf" crossorigin>
+    <style>
+        @font-face {
+            font-family: 'Share Tech Mono';
+            src: url('fonts/ShareTechMono-Regular.ttf') format('truetype');
+            font-weight: 400;
+            font-display: block;
+        }
+        @font-face {
+            font-family: 'Orbitron';
+            src: url('fonts/Orbitron-wght.ttf') format('truetype');
+            font-weight: 400 900;
+            font-display: block;
+        }
+    </style>
     <style>
         html, body {
             margin: 0;
@@ -34,8 +48,8 @@
 </head>
 <body>
     <div id="game"></div>
-    <!-- Phaser 3 via CDN -->
-    <script src="https://cdn.jsdelivr.net/npm/phaser@3.80.1/dist/phaser.min.js"></script>
+    <!-- Phaser 3.80.1 (npm), served from the site -->
+    <script src="phaser.min.js"></script>
     <!-- Game entry (ES module) -->
     <script type="module" src="game.js"></script>
 </body>