Skip to content
Developer Assistance Tools

Security and privacy

Privacy

Section titled “Privacy”

Developer Assistance Tools runs entirely in the browser. There is no backend, no account, no telemetry and no user-data store; each tool does its work on your machine, and the site is designed so that no data leaves the browser. It is a static site deployed on Cloudflare Pages.

Protections

Section titled “Protections”
  • Content-Security-Policy. Pages use default-src 'self' and connect-src 'self' along with the other fetch directives, so a buggy tool or a library that phones home cannot send requests to another host with fetch, XMLHttpRequest, WebSocket, EventSource, sendBeacon, images, fonts, media, frames or form posts.
  • Runtime egress guard. A second layer (js/core/egress-guard.js) refuses those request APIs, and WebRTC and WebTransport, in the page itself.
  • Sandboxing. Code you write in the JS Playground and HTML Viewer runs in sandboxed iframes with an opaque origin. Rendered HTML and Markdown pass through DOMPurify.
  • Integrity. Every build publishes a SHA-256 manifest of its files (offline-manifest.json), and the self-hosted package carries SHA256SUMS.

These protections are enforced in code and checked by the project’s test suite.

Limits and residual risks

Section titled “Limits and residual risks”

The project does not claim to be unhackable. The security policy states these residual risks:

  • Most pages run under a strict CSP: scripts from this origin only, no inline script and no eval. Notepad keeps eval for its JavaScript syntax check, which compiles your text without running it. Three places keep 'unsafe-inline' and 'unsafe-eval' because they cannot work without them: draw.io, the JavaScript Playground and the HTML Viewer. A cross-site-scripting bug on one of those pages could run in the page, and since the tools share one origin it could read that origin’s local storage and IndexedDB.
  • The CSP and the egress guard stop request APIs, not navigation. Script already running on the origin could send data away by moving the tab, or opening a window, to another site with the data in the address. No browser offers a policy that blocks that.
  • Background workers (the SQL engine, the JAR decompiler, the regex tester) are scripts from this origin served without a CSP of their own; they run only the site’s own code and its vendored libraries.
  • Vendored libraries may carry their own vulnerabilities. They are pinned and listed in THIRD-PARTY-NOTICES.txt.

An independent penetration test is recommended before relying on this software in a high-assurance setting.

Self-hosted copies

Section titled “Self-hosted copies”

The self-hosted image sends the same security headers as the public site, stores nothing on the server, and does not need outbound network access. See Self-hosting.

Reporting a vulnerability

Section titled “Reporting a vulnerability”

Report security issues privately using the contact form at https://celesstars.pages.dev/contact. Include steps to reproduce, the affected tool or file, and the impact. The project aims to acknowledge a report within a few business days, and asks for reasonable time to fix an issue before it is disclosed publicly.