I don't know whether it's a part of the joke or not, but I do get a `alert(XSS)` when I load the site from something loaded from https://molt.church/api/canon

I don't think it's part of the joke