Search for a tool or command
Last updated: 19 July 2026
Security at LocalOnly starts with an architecture that removes most of the attack surface entirely: your data never leaves your browser.
LocalOnly is a static, browser-only application. Every tool runs as JavaScript inside your own browser tab. There is no application server that processes your data, no database that stores it, and no user accounts to compromise. This design choice is our single most important security control: an attacker cannot steal data from a server that never receives it, and there is nothing at rest for anyone to breach.
The content you paste, type, or open with a tool is processed locally. We do not upload your input to any endpoint, and we do not transmit it to third parties for processing. Because the work happens on your device, even large or sensitive payloads stay under your control. For more detail on what we do and do not collect, see our Privacy Policy.
The site is served exclusively over HTTPS with modern TLS. Plain HTTP requests are redirected to HTTPS, and we send an HTTP Strict Transport Security (HSTS) header so that conforming browsers refuse to connect over an insecure channel on subsequent visits. This protects the integrity and confidentiality of the application code that your browser downloads.
We apply a defense-in-depth set of response headers to reduce the impact of common web attacks:
The core application does not depend on third-party CDNs to deliver its code at runtime. Assets such as the Monaco editor are self-hosted and served from the same origin as the rest of the site. This narrows the trust boundary and prevents a compromised external script host from injecting code into your session.
We build on well-maintained third-party libraries and keep them updated so that known vulnerabilities are patched promptly. We monitor advisories for the packages we ship and prioritize security-relevant updates.
We welcome reports from security researchers acting in good faith. If you believe you have found a vulnerability, please email hello@sprintoak.com with enough detail to reproduce the issue. We ask that you:
We will not pursue legal action against researchers who follow this policy and act in good faith.
The following generally fall outside our security scope: issues that require a rooted, jailbroken, or already-compromised device; social engineering of our contributors; reports produced solely by automated scanners without a demonstrable impact; and vulnerabilities in third-party services we do not control. Because the app is browser-only, classic server-side categories such as SQL injection or remote code execution on a backend do not apply.
Security is a continuous effort. We plan to keep tightening our Content Security Policy, expand automated dependency auditing, and continue reducing the amount of code that runs with elevated capabilities. If you have suggestions, we would love to hear from you at hello@sprintoak.com.