834 B
Security policy
Report vulnerabilities privately to the repository owner. Supported version: 0.2.x.
MIDI Tools makes no uploads, telemetry or third-party requests. MIDI and SoundFont files are treated as untrusted binary data under the documented size, track, event, SysEx and RIFF-chunk bounds. Worker results are revision-scoped so cancelled or superseded jobs cannot replace newer state.
Web MIDI access is requested only after an explicit click and always with SysEx permission disabled. The app does not subscribe to MIDI inputs; playback sends only bounded channel messages to the output selected by the user, and Stop clears queued messages and sends all-notes-off on every channel. SoundFont files are inspected locally for bounded RIFF metadata and are never synthesized, executed, fetched remotely or sent to a device.