2.0 KiB
Privacy and security
Schema sources, instances, diagnostics, comparisons, and generated samples stay in page memory. There are no accounts, analytics, telemetry, persistence, remote imports, or runtime third-party assets. Explicit source links are normal navigation only. Clearing or closing the page releases application references but cannot promise forensic erasure from browser or operating-system memory.
Each source is limited to 2 MiB of text; a workspace is limited to 20 documents and 8 MiB. JSON/YAML trees are capped at 25,000 values, 48 levels, and 2,000 entries in one collection. XML is capped at 25,000 elements and 48 levels. References, instances, and diagnostics have separate caps. Sample generation is limited to 2,000 nodes, 20 levels, 512 KiB of retained text, 1,024 characters per copied literal, and 2 MiB of serialized output. File byte gates are deliberately conservative before File.text() decoding.
Prototype-sensitive JSON keys, cyclic YAML aliases, NUL input, DTD/entity declarations, absolute/remote/escaping references, and executable schema extensions are rejected. Schematron expressions and imported XML are never executed. JSON Schema formats are annotations, and regex-bearing schema keywords are not executed. The focused validator interprets eligible schemas without dynamic code generation, remote loading, custom code, or unsafe-eval; work and diagnostic counts are capped.
Sample generation and compatibility results are review aids. A generated document is not guaranteed to satisfy every constraint, and an absence of reported changes does not prove compatibility. JSON validation requires a single declared draft and uses local workspace filenames rather than identifier URIs. Named anchors, nested identifier scopes, dynamic/recursive references, unevaluated keywords, regular expressions, and full meta-schema validation are outside v0.1.1. XSD, Relax NG, and Schematron instance validation is also outside v0.1.1; OpenAPI inspection is not a full conformance certification.