feat: publish Regex Tools 0.1.0

docs/SECURITY.md

@@ -0,0 +1,51 @@
+# Security and privacy
+
+Patterns, flags, replacement templates, subjects and imported projects are
+untrusted.
+
+- Syntax and execution use separate workers.
+- Regex execution never occurs on the UI thread.
+- Timeout, crash and cancellation terminate the worker.
+- A terminated worker is never reused.
+- Pattern, subject, replacement/list template, match, capture and output sizes
+  are bounded.
+- Replacement templates are strings; executable callbacks are unavailable.
+- Replacement/list token decorations, rows, chips, diagnostics and list
+  evaluation work have separate presentation/operation caps; incomplete list
+  results cannot be exported.
+- Per-match replacement mapping executes no user code and is capped at 200
+  matches, 2,000 materialized contributions and 50,000 token evaluations.
+- Imported JSON is aggregate-size-bounded before parsing, then field-validated
+  and never evaluated or auto-run. Export and IndexedDB save apply the same
+  32 MiB aggregate UTF-8 document bound before materialization or persistence.
+- Project and standalone-suite test subjects are not exported by default, and
+  unit-test subjects require a separate opt-in before IndexedDB persistence.
+- Unit-test add, update, clone and append-import paths share 1,000-case and
+  32 MiB aggregate state caps.
+- Unit-test assertion diagnostics never stringify complete large values and
+  retain at most 2 KiB UTF-8 per case. Oversized replacement output is not
+  copied into an exact current-result draft.
+- No backend, uploads, telemetry, remote corpus URL, CDN, remote font, `eval`,
+  `Function`, arbitrary command line or unsafe HTML rendering exists.
+
+Version 0.1.0 needs a CSP equivalent to:
+
+```text
+default-src 'self';
+script-src 'self';
+worker-src 'self' blob:;
+connect-src 'self';
+img-src 'self' data:;
+font-src 'self';
+style-src 'self' 'unsafe-inline';
+object-src 'none';
+frame-src 'none';
+base-uri 'none';
+form-action 'none';
+```
+
+The Toolbox shell currently requires inline styles. No `unsafe-eval` or
+`wasm-unsafe-eval` is required until an actual WebAssembly flavour ships.
+
+Report vulnerabilities privately to the repository owner before public issue
+details are posted.