Parse The Data
Local only

Security

A small network surface and an explicit browser boundary.

Reference

Controls that support the local-processing claim

The security design reduces ways dataset contents could leave the tab. These controls are defense in depth, not a claim that any browser application is invulnerable.

Browser controls

  • Dataset parsing runs in a dedicated Web Worker.
  • connect-src 'none' blocks fetch, XMLHttpRequest, WebSocket, and similar application connections.
  • Scripts, styles, fonts, and workers are restricted to the same origin.
  • Forms, embedded frames, plugins, cameras, microphones, location, payments, and USB access are disabled by policy.

Server controls

  • Only GET and HEAD requests are accepted; other methods return 405.
  • The canonical www hostname redirects permanently to the apex domain.
  • HSTS, frame denial, MIME sniffing protection, a strict referrer policy, and cross-origin isolation headers are applied to responses.
  • Versioned browser assets prevent old application code from being mixed with a new release.

Operational limits

The application currently limits local files to 10 MB. It does not provide accounts, shared storage, access controls, audit trails, encryption-key management, certifications, or a formal service-level agreement.

Report a vulnerability

Please avoid including real sensitive data in a report. Submit a private report through GitHub’s security advisory form with reproducible steps and the affected route or release.

Has Parse The Data been independently audited?

No independent security audit or compliance certification is currently claimed. The public controls and source code are available for review.

Can the application make network requests after loading?

The production Content Security Policy sets connect-src to none, which blocks application fetch, XMLHttpRequest, WebSocket, and similar outbound connections.