We build lightning-fast static sites on Eleventy (11ty) , fight for every millisecond in Google PageSpeed - and then sabotage our own speed and security. How? By dropping a third-party <script> for a comment widget onto the page. This guide walks through building a self-hosted, serverless comment system on Firebase Realtime Database: zero external scripts, zero cost, and complete XSS protection. TL;DR Problem: third-party widgets (Disqus, Utterances) slow your site and introduce Supply Chain Attack risk. Solution: Firebase Realtime Database - free, real-time, no third-party scripts. Security: server-side Security Rules + textContent instead of innerHTML on the frontend. Spark Plan (free tier): 1 GB storage · 10 GB/month transfer · 100 simultaneous connections. Time to implement: 2-4 hours with basic JavaScript knowledge.…