1.0 KiB
Privacy and security
Selected files, predicates, intermediate candidates, and results remain in page memory. There is no upload, telemetry, analytics, remote reference resolution, external font, or account. The production policy restricts network connections to the same origin and browser tests reject unexpected requests.
JSON and XML are inert data; dangerous JSON keys and XML document types are rejected. Regular expressions execute in a same-origin worker that can be terminated. XSLT is limited to a local, bounded stylesheet and rejects imports, includes, hrefs, DOCTYPE, and known external-resource functions. Browser-native XSLT is synchronous and cannot be pre-empted mid-call, so only trusted local stylesheets should be tested despite those safeguards.
A reduced input demonstrates only the recorded predicate. It is not proof that the original root cause, security impact, timing characteristic on another machine, or standards conformance remains identical. Review the exported trace and keep failure-signature preservation enabled where available.