File security
- On-device tool inputs are not sent to a processing API.
- No application account or server-side file history exists in V1.
- Results are generated locally for direct download.
Security starts by reducing what we need to receive.
V1 keeps tool processing on-device and serves the application as static files.
Application security
- Restrictive Content Security Policy and permissions policy.
- No secrets embedded in client code.
- Versioned third-party dependencies and documented provenance.
- Same-origin service worker cache.
Report a vulnerability
Please use the Contact page and clearly mark the message as a security report. Do not publicly disclose an exploitable issue before there has been a reasonable opportunity to review it.
Contact instructions →