Release Fixture Tools 0.1.0

docs/PRIVACY-SECURITY.md

@@ -0,0 +1,18 @@
+# Privacy and security
+
+Files are read only after direct selection and remain in browser memory. There
+is no telemetry, analytics, account, upload, remote reference resolution,
+external font, or service dependency. The production content policy restricts
+connections to the same origin, and browser tests reject unexpected requests.
+
+Imported JSON, SQL, XML, and CSV are treated as data. SQL is never executed;
+XML document types and entity declarations are rejected. React renders values
+as text. CSV exports prefix formula-like cells to reduce spreadsheet injection,
+and SQL identifiers/literals are quoted by the serializer. These mitigations do
+not replace review before feeding intentionally invalid fixtures to another
+system.
+
+Generated values are synthetic and use reserved example domains. They are not
+anonymized real data, security tokens, cryptographic randomness, compliance
+evidence, or a statistical population model. A seed intentionally reproduces
+the same output and should not be treated as secret material.