archive-tools/docs/PRIVACY-SECURITY.md

Privacy and security

Privacy

Inputs remain in the browser. There is no telemetry, account, analytics, upload endpoint, persistence or runtime CDN. Object URLs exist only long enough to display or download local results and are revoked after use.

Threat model

Archives are adversarial binary input. Relevant risks include traversal and alternate-stream names, normalization/case collisions, deceptive local versus central ZIP headers, overlapping ZIP entries, CRC corruption, compression bombs, integer overflow, excessive counts, malformed PAX lengths, active HTML/SVG, recursive nested archives and special filesystem entries.

Archive Tools responds as follows:

• source, count, expanded-byte, per-entry, ratio, path and preview budgets are fixed in src/archive/limits.ts;
• byte arithmetic uses checked safe integers and bounds before slicing;
• extraction never targets the filesystem: eligible content is verified and repackaged into a newly created ZIP;
• ZIP content reads enable CRC-32, strict local/central agreement and overlapping-entry checks;
• every TAR header checksum is verified, PAX metadata is bounded and GNU long-name extensions are refused;
• gzip output is counted during streaming and its CRC-32/ISIZE footer is independently verified;
• path collision keys are Unicode-normalized and conservative across case-insensitive platforms;
• symlinks, hardlinks, devices, FIFOs and unknown types are never restored;
• imported text is rendered as text, and HTML/SVG are not mounted as documents;
• raster images must pass byte/dimension/pixel/static checks before a browser decoder sees their Blob URL;
• nested archives are shown as bytes and never recursively opened;
• encrypted and multipart ZIP data is unsupported, with no password collection.

Limits

The primary ceilings are 512 MiB source and aggregate expanded data, 256 MiB per entry, 20,000 entries and a 200:1 compression ratio. Preview limits are substantially smaller. Near-limit workloads may still be impractical on low-memory devices; the limits reduce risk but do not make untrusted archives inherently safe.

Output meaning

“Safe file” means eligible for bounded verification and inclusion in a new ZIP under this policy. It is not a malware verdict. Archive Tools does not scan file semantics and does not make copied files trustworthy to open in another application.