Security

Security practices built around untrusted input

Tool visitors paste code, structured data, and documents. The platform treats that input as untrusted and keeps local processing as the default where practical.

Browser processing

Local tools perform their main operation on the visitor device.

  • Input is rendered as text or sanitized output
  • Pasted JavaScript is not executed as application code
  • Large-file limits reduce browser lockups
  • Local workspace data can be cleared by the visitor

Application protections

Server routes use restrictive defaults and separate public, administrative, and account concerns.

  • Content Security Policy and security headers are configured
  • Sensitive project directories are blocked from public access
  • Server endpoints validate methods and payload sizes
  • Runtime JSON writes use temporary files and atomic replacement

Account security

Accounts are optional and disabled until the database migration and configuration are complete.

  • Passwords use PHP password hashing
  • Account and administrator sessions use separate cookie names
  • Authentication forms use CSRF tokens
  • Login and registration attempts are rate limited

Responsible reporting

Security reports should include reproducible details without exposing private user data.

  • Do not test against other visitors
  • Do not publish secrets or personal data
  • Allow reasonable time for review
  • Use the configured security contact