19 lines
1.0 KiB
Markdown
19 lines
1.0 KiB
Markdown
# Privacy and security
|
|
|
|
Selected files, predicates, intermediate candidates, and results remain in page
|
|
memory. There is no upload, telemetry, analytics, remote reference resolution,
|
|
external font, or account. The production policy restricts network connections
|
|
to the same origin and browser tests reject unexpected requests.
|
|
|
|
JSON and XML are inert data; dangerous JSON keys and XML document types are
|
|
rejected. Regular expressions execute in a same-origin worker that can be
|
|
terminated. XSLT is limited to a local, bounded stylesheet and rejects imports,
|
|
includes, hrefs, DOCTYPE, and known external-resource functions. Browser-native
|
|
XSLT is synchronous and cannot be pre-empted mid-call, so only trusted local
|
|
stylesheets should be tested despite those safeguards.
|
|
|
|
A reduced input demonstrates only the recorded predicate. It is not proof that
|
|
the original root cause, security impact, timing characteristic on another
|
|
machine, or standards conformance remains identical. Review the exported trace
|
|
and keep failure-signature preservation enabled where available.
|