Security

Tools run in your browser

Every workbench tool currently marked as available is a deterministic analyzer implemented as client-side code. When you paste a Terraform plan, a Dockerfile, or command output:

• It is processed in your browser by JavaScript already loaded with the page
• No request is made to our servers or to any third party with that content
• Nothing is stored, logged, or transmitted
• It is gone when you close the tab

You do not have to take that on trust. Open your browser’s network inspector and press Analyze: nothing happens. The analyzers are ordinary modules in the page bundle, and the site is open about which tools are deterministic and which would need a server.

Tools that require model inference are marked as not built on the tools page, precisely because doing them properly requires the server-side controls listed there — request authentication, rate limiting, a redaction pass so pasted logs never persist credentials, and stated retention terms. We would rather ship those late than ship them carelessly.

What this site collects

The site is statically generated and served without an application backend. There are no accounts yet, so there is nothing to log into and no user data to hold. Analytics, where enabled, are privacy-conscious, aggregate, and carry no cross-site identifiers. There is no advertising and no third-party tracking script.

Application security

The site is built to standard hardening practice for a static property:

• Transport — HTTPS only, with HSTS
• Content Security Policy — restrictive, with no third-party script or style origins; fonts are self-hosted rather than pulled from a font CDN
• Framing — denied
• MIME sniffing — disabled
• Referrer policy — strict-origin-when-cross-origin
• Output encoding — all analyzer output is written to the DOM as text, never as markup, so pasted content cannot become executable
• Dependencies — audited, and kept to a small set

Recommended headers are shipped in the repository alongside the deployment configuration so the policy is version-controlled rather than set by hand in a console.

No secrets in the frontend

There are no API keys, tokens, or credentials in the client bundle, because the client makes no authenticated requests. When server-side capabilities are added, secrets will live in the server environment and will not be reachable from the browser.

Reporting a vulnerability

If you find a security issue in this site or its tools, please report it before disclosing it publicly. Go to contact and mark the message as a security report.

Please include what you found, how to reproduce it, and what an attacker could do with it. We will acknowledge the report, tell you what we intend to do, and credit you if you want to be credited.

We ask that you do not run automated scans that degrade the service for other people, and that you do not access or modify data that is not yours.

Security in what we publish

Our technical content treats security as an operational property rather than a separate topic: runbooks state blast radius before steps, destructive operations carry warnings and rollbacks, and the Docker auditor exists partly because secrets in image layers are one of the most common real exposures we see.

Where we describe an attack or a failure mode, it is to help you defend against it in systems you are responsible for.