api-tools/docs/PRIVACY-SECURITY.md

Privacy and security

Descriptions and exchanges remain in memory and are never transmitted or persisted. All remote/absolute $ref forms fail closed. Displayed URLs are text, not links. There is no Try It button, OAuth flow, DNS lookup, HTTP execution, telemetry or external asset.

HAR and saved exchanges commonly contain tokens, cookies, personal data and payloads. The summary does not render header values, yet the source editor still contains them. Clear it before sharing. Generated examples are heuristic and must not be treated as valid production data. Validation and compatibility checks cover a useful subset, not every OpenAPI or JSON Schema rule.