19 lines
1.0 KiB
Markdown
19 lines
1.0 KiB
Markdown
# Privacy and security
|
|
|
|
Files are read only after direct selection and remain in browser memory. There
|
|
is no telemetry, analytics, account, upload, remote reference resolution,
|
|
external font, or service dependency. The production content policy restricts
|
|
connections to the same origin, and browser tests reject unexpected requests.
|
|
|
|
Imported JSON, SQL, XML, and CSV are treated as data. SQL is never executed;
|
|
XML document types and entity declarations are rejected. React renders values
|
|
as text. CSV exports prefix formula-like cells to reduce spreadsheet injection,
|
|
and SQL identifiers/literals are quoted by the serializer. These mitigations do
|
|
not replace review before feeding intentionally invalid fixtures to another
|
|
system.
|
|
|
|
Generated values are synthetic and use reserved example domains. They are not
|
|
anonymized real data, security tokens, cryptographic randomness, compliance
|
|
evidence, or a statistical population model. A seed intentionally reproduces
|
|
the same output and should not be treated as secret material.
|