Security

The architecture is the control

There is no application server, no database and no user accounts. That removes most of the categories of breach a web tool normally worries about: there is no stored user data to exfiltrate and no session to hijack.

What we do in the browser

• Nothing is evaluated. Formatters parse your input into a syntax tree and print it back. No tool passes input to eval or new Function.
• Markdown and HTML previews are sanitised with DOMPurify and then rendered inside a sandboxed iframe with no script permission.
• YAML is parsed with the CORE schema, which excludes the tags that can construct arbitrary objects.
• XML parsing does not process DTDs or resolve external entities, so XXE is structurally impossible.
• JSONPath filters run in a sandboxed interpreter rather than through eval.
• Regular expressions are evaluated in a worker that the main thread terminates if it exceeds its time budget, so a catastrophic pattern cannot freeze your tab.
• Randomness comes from crypto.getRandomValues, never Math.random, for every generator that produces a key, password or identifier.

Reporting a vulnerability

Email hello@devtoolery.org with steps to reproduce. Please give us a reasonable window to fix an issue before publishing it. We will credit you unless you would rather we did not.

In scope: anything that causes a tool to execute pasted content, a sanitiser bypass, or a way to make the site transmit user input off the device. Out of scope: missing headers on the CDN with no demonstrated impact, and reports generated by a scanner without a working proof of concept.