These are static, client-side tools. They run in your browser and do not send your data anywhere.

If you find a security issue, please report it by opening a GitHub issue on the affected repository. There are no private reporting channels — the tools are open source and client-side, so vulnerabilities are typically discoverable in the source.

• XSS vectors in user-generated content
• Data leaks (anything that sends user data off-device)
• Supply chain risks in vendored or embedded dependencies

• Client-side-only data in localStorage (that's the browser's security model)
• Content that requires physical or shell access to the device
• Social engineering