1002 B
Security
Report vulnerabilities privately through the Gitea repository owner. Never attach confidential datasets publicly. Inputs are untrusted, bounded, rendered inertly, and never evaluated as application code; XML DTD/entities and dangerous JSON keys are rejected.
The built-in query languages use fixed parsers and interpreters without eval
or dynamic function construction. DuckDB mode accepts one parsed SELECT
statement, rejects semicolons and mutation, extension, attachment, file and
configuration keywords, then executes against a bounded in-memory table in a
disposable locally bundled WASM worker. External access and extension
installation/loading are disabled; startup/query deadlines terminate the worker
and stale results cannot replace newer state.
Deployment must serve the bundled WASM with application/wasm and a CSP that
allows same-origin WASM and workers while keeping connect-src 'self'. Browser
release tests verify those headers and fail on third-party requests.