Security

Our security model

LocalOnly is a static, browser-only application. Every tool runs as JavaScript inside your own browser tab. There is no application server that processes your data, no database that stores it, and no user accounts to compromise. This design choice is our single most important security control: an attacker cannot steal data from a server that never receives it, and there is nothing at rest for anyone to breach.

No uploads, no transmission

The content you paste, type, or open with a tool is processed locally. We do not upload your input to any endpoint, and we do not transmit it to third parties for processing. Because the work happens on your device, even large or sensitive payloads stay under your control. For more detail on what we do and do not collect, see our Privacy Policy.

Encryption in transit

The site is served exclusively over HTTPS with modern TLS. Plain HTTP requests are redirected to HTTPS, and we send an HTTP Strict Transport Security (HSTS) header so that conforming browsers refuse to connect over an insecure channel on subsequent visits. This protects the integrity and confidentiality of the application code that your browser downloads.

Security headers

We apply a defense-in-depth set of response headers to reduce the impact of common web attacks:

• Content-Security-Policy restricts which sources scripts, styles, and other resources may load from, mitigating cross-site scripting.
• X-Frame-Options: DENY prevents the site from being embedded in a frame, blocking clickjacking.
• X-Content-Type-Options: nosniff stops browsers from guessing content types and executing them unexpectedly.
• Referrer-Policy limits how much URL information is shared when you navigate away.
• Permissions-Policy disables browser features and APIs the app does not need.

Self-hosted assets

The core application does not depend on third-party CDNs to deliver its code at runtime. Assets such as the Monaco editor are self-hosted and served from the same origin as the rest of the site. This narrows the trust boundary and prevents a compromised external script host from injecting code into your session.

Dependencies

We build on well-maintained third-party libraries and keep them updated so that known vulnerabilities are patched promptly. We monitor advisories for the packages we ship and prioritize security-relevant updates.

Responsible disclosure

We welcome reports from security researchers acting in good faith. If you believe you have found a vulnerability, please email hello@sprintoak.com with enough detail to reproduce the issue. We ask that you:

• Give us a reasonable amount of time to investigate and remediate before any public disclosure.
• Do not publish details of the issue until a fix has been released.
• Avoid privacy violations, data destruction, or service disruption while testing.

We will not pursue legal action against researchers who follow this policy and act in good faith.

Out of scope

The following generally fall outside our security scope: issues that require a rooted, jailbroken, or already-compromised device; social engineering of our contributors; reports produced solely by automated scanners without a demonstrable impact; and vulnerabilities in third-party services we do not control. Because the app is browser-only, classic server-side categories such as SQL injection or remote code execution on a backend do not apply.

Ongoing improvements

Security is a continuous effort. We plan to keep tightening our Content Security Policy, expand automated dependency auditing, and continue reducing the amount of code that runs with elevated capabilities. If you have suggestions, we would love to hear from you at hello@sprintoak.com.