Release Diff Tools 0.2.0

docs/PRIVACY-SECURITY.md

@@ -13,6 +13,9 @@ The production CSP permits same-origin scripts and workers and blocks objects, f
 - XML containing DOCTYPE, entity declaration or XInclude syntax is rejected before DOM parsing. A lexical preflight rejects excessive element count or nesting before DOM construction.
 - JSON rejects duplicate keys and the prototype-affecting keys `__proto__`, `prototype` and `constructor`.
 - CSV/TSV fields remain strings; formulas are displayed as text and are not evaluated.
+- Directory hashing rejects traversal, absolute/control-laden and case/Unicode-colliding relative paths. SHA-256 reads use bounded concurrency, file/count/aggregate ceilings and an abort signal.
+- Imported manifests are schema-, path-, digest-, order- and total-validated before comparison. Directory names and digests are sensitive metadata and should be reviewed before sharing.
+- Three-way inputs use the same text ceilings plus an explicit conflict cap; conflict labels have CR/LF removed before entering marker lines.
 - Imported strings are rendered through React text nodes and form controls. No library-generated HTML, imported markup or script is inserted into the document.
 
 These controls bound this tool's work; they are not a general-purpose sanitizer and do not make imported data safe for another application.