Spaces:
Running
Running
| # Browser security and privacy | |
| The demonstration has no server-side application, telemetry, login, third-party inference or API keys. Data JSON is loaded as a static same-origin asset and the sample text the user enters is evaluated inside the browser. It is not saved to persistent storage by the app, and is not sent to ChatGPT, Hugging Face inference or another API. | |
| - UI escapes user-provided and dataset strings before inserting into HTML to reduce XSS risk. | |
| - CSV downloads neutralize spreadsheet formula injection for values beginning with risky characters. | |
| - No dynamic code evaluation, script imports from remote CDNs, or token handling. | |
| - No personal records should be imported or entered; use only nonconfidential demonstration text. | |
| - Repository is public; never upload passwords, API keys or confidential datasets. | |
| The supplied browser tests run without network access. Hosting on a third-party website can entail independent platform logs and policies not controlled by this app. | |