OSCAL Workbench 0.1.0 is a local Windows development preview. The measures described here are implemented boundaries, not a government accreditation, a penetration-test result, or a guarantee that hostile files are safe. Use the supported-features guide for release limits.

The launcher binds to 127.0.0.1 on an available port. A one-use launch token establishes an HttpOnly, SameSite=Strict session cookie. API requests require that session. Mutation requests check the same origin; the app also checks the local Host header and sends restrictive framing, content-type and content-security headers. There is no supported LAN exposure, reverse-proxy hosting, multi-user login, or remote administration configuration.

These controls reduce browser-based cross-origin access. They do not isolate the application from malware, a privileged administrator, or another process running as the same Windows user. Do not share launch links or alter the bind address to turn this preview into a shared service.

The selected workspace holds the SQLite database, its working files, the protected workspace key, and app-managed temporary storage. By default it is workspace beside the source tree or portable executable. The launcher directs its temporary-file environment to workspace/tmp. Source, builds and development dependencies for this checkout are under Downloads.

Record payloads and audit payloads use AES-256-GCM. On Windows, DPAPI protects the workspace encryption key for the current Windows user. Saved provider and Snowflake configuration, including secrets, is encrypted in that local store; the API omits secret fields from ordinary configuration responses. This is not a separate enterprise secrets vault. Process memory necessarily contains plaintext while records or credentials are in use.

Database row types, record IDs, timestamps, identity hashes, audit chain digests and filesystem metadata are not all encrypted. Browser downloads and exported OSCAL artifacts are plaintext. Local RSA private key files remain at the user-selected path, under that path's own protection. Windows paging, crash dumps, browser state, security software and backup behavior are outside the application's full control. Use organizational device encryption, account access controls and an appropriate retention policy.

The non-Windows development fallback stores the encryption key as a local file with restrictive creation permissions; it lacks Windows DPAPI protection. This preview's security target is Windows. Do not treat the fallback as equivalent protection for sensitive data.

Do not delete .workspace-key independently from its database: saved records can become unrecoverable. Copying the workspace to a different user or machine is not a supported plaintext migration method because the key is user-protected. Backup and recovery need a tested, organization-approved process. Deleting a conversion removes its logical record; it is not a forensic secure-erasure feature for SQLite pages, backups or exported copies.

The local audit trail chains authenticated records, but it is not an independently witnessed append-only log. An actor who controls the same account, application and key is outside that integrity boundary.

Uploads are size- and count-bounded. The ZIP path checks reject escapes, unsafe members and excessive expansion. Office validation rejects active/unsafe content and spreadsheet formulas. PDF extraction rejects encryption and unreadable scans. JSON/YAML parsing rejects duplicate keys and unsupported representations. XML disables DTD/entity/network resolution and uses pinned official converters and schemas.

File parsing runs in a separate worker with a time and memory bound. This is resource containment, not a Windows AppContainer, virtual machine, network-denied process, or protection against every parser-library exploit. Inputs are not executed as macros, scripts or SQL. An antivirus gateway, content-disarm system and comprehensive document malware scanner are not included.

Plaintext output still requires care when another tool opens it. Generated CSV guides and templates do not imply that arbitrary company CSV content is safe to open in spreadsheet software. Preserve identifiers and text using an approved import process.

Rules-only conversion does not call an AI provider. AI mode requires a configured provider and consent to transmit source content. The request includes selected/extracted source text and tables, user decisions, a template dictionary, concise instructions, and public synthetic examples. A provider capability test also makes a network request with synthetic content.

The default data policy allows public/synthetic sources. Nonpublic content requires an organization-approved configuration. This policy label does not inspect every sensitive field, verify your contract, determine residency, or guarantee provider retention terms. The person configuring a deployment must verify its permitted data classes and use conditions. Automatic redaction and data-loss-prevention classification are not included.

Provider destinations are restricted to supported official HTTPS origins. Redirects and ambient HTTP proxy configuration are not followed by the AI HTTP client. The code validates destinations and rejects restricted network addresses unless an exact private Azure hostname is explicitly permitted. Custom gateways are unsupported. This is application-level destination checking, not a network firewall or a complete defense against DNS changes.

The model receives no independent tool access. Uploaded documents are treated as data, and instructions demand source-cited proposals without invented owners, dates, UUIDs, facts, evidence or assessments. Exact quotation checking and schema checks reject certain malformed responses; human review is still needed for prompt injection, omission, misunderstanding and misleading-but-valid output. No automated check establishes truth.

Raw provider error bodies are not exposed as user-facing failures. Requests have bounded input/output and timeout settings, and there is no silent provider fallback. A timed-out request may already have been processed or billed; review provider-side status before retrying a costly operation.

Connections use the official Snowflake driver with timeouts and a query tag. The app quotes selected object identifiers and provides metadata discovery plus SELECT snapshots. It does not accept arbitrary SQL. It also cannot remove privileges from an overpowered Snowflake role: grant a dedicated role only the necessary database/schema access, SELECT rights and warehouse usage.

Browser SSO and MFA can prompt interactively. Use an approved service identity and RSA key pair for schedules that must run without interaction. The connector accepts RSA keys of at least 2048 bits. Keep encrypted key files and their passphrases outside the repository. Driver/operating-system token caching can depend on installed credential components and account configuration; review that behavior in a real integration test.

Snapshots contain the selected business data and can be sensitive even when their columns look operational. They are stored locally with the run. A query hash is provenance, not proof that a source row was accurate or that the selected population was complete.

Commit source code, synthetic examples, templates, tests and pinned public reference assets. Do not commit the real workspace, uploaded company files, exports containing customer data, credentials, RSA keys, build caches, or service tokens. Inspect staged files before publishing. Development dependency version ranges are not a fully locked, attestable release supply chain.

Before distributing a production release, complete signing, clean-Windows installation testing, dependency/license review, real provider and Snowflake tests, backup/recovery validation and independent security assessment. No live customer system or real provider account was used to establish this preview's readiness. The current build does not claim FIPS validation or compliance with a particular government security baseline.

Dependency evidence was captured on 2026-09-07 from the Python 3.12 project environment and the checked-in ui/package-lock.json: reports/python-audit.json covers the 94 locked Python distributions with pip-audit, and reports/npm-audit.json covers the frontend lockfile with npm audit. Both reports recorded zero known vulnerabilities at that time. These are point-in-time tool results and are not a guarantee that future advisories, transitive code, or redistribution obligations do not exist. The accompanying SBOM and license notices record the package versions and attribution review scope.

No private security reporting channel is provisioned for this preview. If you report a non-sensitive problem in the public issue tracker, include the affected version and a minimal synthetic reproducer. Do not put credentials, company documents, private keys, or sensitive exploit details in a public issue; arrange a private maintainer channel before sharing those details.