1.0 KiB
Privacy and security
Files are read only after direct selection and remain in browser memory. There is no telemetry, analytics, account, upload, remote reference resolution, external font, or service dependency. The production content policy restricts connections to the same origin, and browser tests reject unexpected requests.
Imported JSON, SQL, XML, and CSV are treated as data. SQL is never executed; XML document types and entity declarations are rejected. React renders values as text. CSV exports prefix formula-like cells to reduce spreadsheet injection, and SQL identifiers/literals are quoted by the serializer. These mitigations do not replace review before feeding intentionally invalid fixtures to another system.
Generated values are synthetic and use reserved example domains. They are not anonymized real data, security tokens, cryptographic randomness, compliance evidence, or a statistical population model. A seed intentionally reproduces the same output and should not be treated as secret material.