SECURITY.md

Security and privacy

• No tokens, API credentials, external paid services or telemetry are needed.
• All user imported data is parsed and analyzed entirely in the browser; nothing is automatically uploaded by this app. Avoid importing personal or confidential data anyway.
• Imports are capped at 12 MB and 30,000 rows, with basic field validation and duplicate-key rejection. This is not a complete malware scanner or data-sanitization system.
• User-provided values are HTML-escaped in the rendered tables. CSV exports prepend a single quote to cells beginning with common spreadsheet-formula prefixes.
• Full session and prediction exports may include original text from imported data. Review the contents before sharing.
• The only network requests performed by application code are to this Space's local evaluation_snapshots.json and benchmark_manifest.json.
• The page contains no third-party JavaScript, external font imports or background trackers.