1.5 KiB
Security and privacy
Local-first boundary
Sudoku Tools has no application network client, remote puzzle resolver, telemetry or account system. File and text imports are read locally. The Toolbox shell may fetch its same-origin catalogue when the app is launched from the Portal; that catalogue never receives puzzle contents.
Browser developer tools, extensions, a compromised host page, or any other script trusted on the same origin remain outside this application's security boundary. Exported files and URL fragments are plaintext puzzle data.
Untrusted input
Imported text, JSON, URLs and local database records are untrusted. Parsers use explicit schemas and limits for input bytes, dimensions, cells, constraints, metadata and saved records. Unknown variant constraints fail visibly. User text is rendered as React text and is never inserted as HTML. Imported links are not opened automatically.
Solver and generator searches are bounded, cancellable and run in a worker. Solution counting stops after the requested cap—two by default for uniqueness. The UI remains usable if a worker is cancelled or fails.
Persistence
IndexedDB records are versioned and bounded. Saving is explicit; deleting a project or clearing the local library removes only this application's records. Private browsing, browser storage pressure and profile clearing may erase them, so important puzzles should be exported.
Reporting
Please report vulnerabilities privately to the repository owner before opening a public issue when disclosure could expose users.