Security
A small utility can still handle high-impact data.
Security controls focus on reducing disclosure, constraining active content, making failure visible and correcting unsafe tools quickly.
Secure-use baseline
- Use synthetic, redacted or expired artefacts whenever possible.
- Never treat decoding as signature or identity verification.
- Check processing and sensitivity labels before using a tool.
- Do not include live credentials or customer payloads in a report.
- Verify high-impact results with an authoritative system or second implementation.
Application controls
The launch baseline includes a restrictive content policy, sanitized and sandboxed active previews, explicit file limits, tested failure states, dependency review, no payload telemetry and no advertising runtime in tool workbenches.
The application is statically exported. Any future payment, account, live-check or sync service requires a separately reviewed HTTPS backend; secrets and entitlement authority must never be placed in the browser bundle.
Report a vulnerability
Do not submit exploit payloads containing real third-party data. Include the affected route, impact, minimal reproduction and suggested remediation. The approved private reporting address must be configured by the project owner before public beta.
Prepare a security report