diff --git a/src/frontend/flask_app/tests/test_offline.py b/src/frontend/flask_app/tests/test_offline.py
index a2798b3..2333242 100644
--- a/src/frontend/flask_app/tests/test_offline.py
+++ b/src/frontend/flask_app/tests/test_offline.py
@@ -9,6 +9,7 @@ cdn...">` because it is the quickest way to try something, it works at their des
 and nobody finds out until the machine is on the shop floor.
 """
 import re
+import subprocess
 from pathlib import Path
 
 import pytest
@@ -32,12 +33,43 @@ _DOC_HOSTS = (
 )
 
 
+def _tracked_files():
+    """The files git knows about, or None when git cannot answer.
+
+    Being outside `vendor/` is not the same as being ours. A scratch copy of a
+    library dropped into `static/js/` to debug something looks first-party and is
+    not: it is not in the repository, it never reaches the shop floor, and its
+    comments are not our comments. Trackedness is the honest test for that.
+
+    Trackedness, and not `.gitignore`: an ignore pattern says nothing about a
+    file that is already tracked, so matching patterns would be the wrong
+    question.
+
+    When git cannot answer we scan everything, as before. A guard test that goes
+    quiet the moment it loses its footing is worse than one that cries wolf.
+    """
+    try:
+        listed = subprocess.run(
+            ["git", "ls-files", "-z"],
+            cwd=APP_ROOT, capture_output=True, text=True, check=True,
+        ).stdout
+    except (OSError, subprocess.SubprocessError):
+        return None
+    return {(APP_ROOT / name).resolve() for name in listed.split("\0") if name}
+
+
 def _first_party_files(suffixes):
+    tracked = _tracked_files()
+
+    def is_ours(path):
+        return tracked is None or path.resolve() in tracked
+
     for path in sorted(STATIC.rglob("*")):
-        if path.suffix in suffixes and "vendor" not in path.parts:
+        if path.suffix in suffixes and "vendor" not in path.parts and is_ours(path):
             yield path
     for path in sorted(TEMPLATES.rglob("*.html")):
-        yield path
+        if is_ours(path):
+            yield path
 
 
 def test_no_template_loads_anything_from_the_network():