Over the last decade the average web application has transformed from a stack of statically rendered pages strung together into massively complex heaps of javascript we ship and run on client devices. The code running on our devices web browsers is vast and mostly unreadable, users must trust that the websites they visit are being transparent about what they are doing, and so far this has worked out without catastrophic breaches of privacy.