Embedding X Posts Without Loading X's Script: Static Cards for Social Posts That Handle Backups, Privacy and Deletions

While writing the Ledger reseller incident, I wanted to include a few key X posts in the article: from Ledger itself, from Ledger’s CTO, and from the researchers who opened up the devices with their own hands. I also wanted to keep a backup in case the posts were later deleted or edited.

The short version: to embed X posts, I did not use the official embed code. I built static cards from my own archive instead. A card holds the screenshot stored on this site, the author, the posting time and a “View on X” link, plus the full text for long posts and, where needed, the photos from the post. The card loads none of X’s scripts, and it keeps showing even if the original post is deleted.

This is a record of how Jason Finance is built, and it reflects the state on 17 October 2026. X’s embedding methods and privacy notice may change; X’s official documentation is authoritative. This is not legal advice. Before quoting other people’s posts and photos, check the copyright rules that apply to you.

The problem with the official embed code: every reader connects to X

X’s official way to embed is to load the platform.x.com/widgets.js script on the page (X developer documentation). As soon as the script loads, the reader’s browser connects to X. According to X’s own notice, when readers view embedded posts, buttons or timelines on a website, X may receive the web page they are visiting, their IP address, browser type, operating system and cookie information, and keeps this browsing data for up to 30 days (X for Websites privacy notice, checked on 17 October 2026).

Jason Finance’s public pages are static, and as a rule they carry no third-party scripts (the architecture is in Jason Finance from Zero to One). The only cookies listed in the privacy policy are Google Analytics and Cloudflare’s security cookies. Adding X’s script for a few posts would mean every reader who opens this article connects to X, and the privacy policy would need one more company in it.

The official embed has another problem: once a post is deleted, the embed shows nothing. What I wanted to keep was exactly what each party said at the time of the incident, and posts like these may also be deleted or edited later.

What a static card looks like

Each card contains:

• Post screenshot: the screenshot archived by this site; clicking it opens the original post in a new tab.
• Author and time: the author’s name, @handle and posting time. The Traditional and Simplified Chinese editions use Taiwan time; the English and Spanish editions use UTC.
• Link to the original and archive date: “View on X ↗”, with a line of small text below it reading “Screenshot archived by Jason Finance on 2026-10-15”.
• Full text of long posts: for a long post, X’s screenshot shows only up to “Show more”, so the card for that post adds an expandable “Full text of the post” section. Short posts do not show this section.
• Optional photos: not every photo attached to a post is included; only the ones the article specifies are shown, and clicking one opens it full size.

Screenshots and photos are lazy-loaded, so they download only when the reader scrolls near them. A screenshot’s alt text is the author plus the first 240 characters of the post, so readers who cannot see images, and search engines, can still read the content.

How the archive is made: text, photos and screenshots

The archive has three parts, and all of them use only public sources that need no login:

1. Text and photos: X’s public embed data provides the post URL, author, posting time, text, quoted post and list of photos.
2. Full text of long posts: the embed data truncates long posts, so the full text comes from FxTwitter, a public mirror service.
3. Screenshots: Chromium, a headless browser, opens X’s own embed page and captures the post the way X displays it, saved as a WebP image.

For the Ledger incident, 20 posts were archived in total. Each one has its full text and a screenshot, and photos were saved for the posts that had them, 20 photos in all. The archive date is 15 October 2026.

Keeping the archive separate from the site: only the files in use go live

The full archive, about 4.8 MB, sits in a folder in the repo that is never published (docs/archive/), and the site does not serve these files. The folder includes a note that spells out which article the archive is for, the date, where it was fetched from, and that the copyright in the photos belongs to the original authors.

The site holds only the files the article actually uses: screenshots of 6 posts and 6 photos, about 2 MB, with the data organized separately into a JSON file. When an article needs to quote other posts or photos later, they are copied over from the archive. This has two benefits: readers do not download images that are not used, and posts and photos that are not yet used do not appear on the site.

Placing a card in an article: one marker line, swapped for a card at build time

Posts are Markdown files, and placing a card takes just one line of HTML markup:

<div data-x-post="post ID" data-media="1,2"></div>

data-x-post is the post’s ID, and data-media says which photos to show (counting from 1, and optional). When the site is built, a Markdown plugin replaces this line with the card’s HTML. Readers get a finished static page, and the browser does not need to run any code.

A few safeguards:

• If the ID is not in the data, the build fails, with an error message reminding you to add the post to the data file first, so no empty card is left on the site.
• The marker works only in posts; placing it on any other page also fails the build.
• A test checks that the card’s HTML contains no <script>, widgets.js or X platform URL, so if someone changing the code later adds X’s script back by accident, the test fails.
• Another test confirms that every screenshot the data file points to actually exists on the site.

The card’s text is generated in the page language, so the same marker line can be copied as is into the Simplified Chinese, English and Spanish editions, with no extra work during translation.

The video could not be downloaded: linking to chapter timestamps instead

The same article also cites a Chinese-language teardown video of the Ledger Stax. I wanted to keep a copy of it too, but when downloading from the server where we run Claude Code, YouTube blocked it.

In the end I did not save the video. The article lists the timestamps of a few key segments instead, each one a YouTube link that jumps straight to that segment, for example “07:00 back cover comparison”. Readers do not have to watch from the start; they click whichever segment they want to check. The trade-off is that if the video is taken down, these links stop working, so the article also sets out the video’s key points in text.

Copyright: photo authors and how the photos are used

The copyright in the archived photos and screenshots still belongs to the original authors. This site handles them as follows:

1. Only as quoted evidence: photos appear only in the passages that explain the incident, to show readers which part of the device to look at. They are not used as decoration or cover images.
2. Always credit the author and link back to the original post: every card has the author’s name, handle and a link to the original post, and the photo’s alt text names the author too.
3. Only the photos that are needed: if a post has four photos and the article needs only one, only that one is included.

FAQ

Why not use X's official embed code to embed X posts?

The official embed code loads X's widgets.js. According to X, when readers view an embedded post, X may receive the web page they are visiting, their IP address, browser, operating system and cookie information. Jason Finance's privacy policy does not list X, so the site uses static cards that do not load X's script instead.

What is in a static card?

A screenshot of the post archived by this site (clicking it opens the original post), the author's name and handle, the posting time (Taiwan time in the Chinese editions), a "View on X" link and the archive date. For long posts the screenshot stops at "Show more", so the card adds the full text in an expandable section; photos attached to the post are added when needed.

Can I still see the card if the original post is deleted?

Yes. The screenshot, text and photos are all stored on this site, and the card does not request anything from X when it is displayed; only the "View on X" link stops working.

How was the post content saved?

The text and photos come from X's public embed data, and the full text of long posts is filled in from FxTwitter, a public mirror service; the screenshots were taken by opening X's own embed page in Chromium, a headless browser. For the Ledger incident, 20 posts were archived in total.

Are all the archived files published on the site?

No. The full archive, about 4.8 MB, sits in a folder that is never published; the site holds only the 6 post screenshots and 6 photos the article actually uses, about 2 MB.

What should I watch out for when quoting other people's photos?

The copyright in the photos belongs to the original authors. This site uses them only as quoted evidence when explaining an event; the card names the author and handle and links back to the original post.