Skip to content

Repository navigation

Security: toolaska/online-compiler

Security

SECURITY.md

Security & Privacy Policy

🔒 Client-Side Sandbox Guarantee

The core design principle of Toolaska Quick Compiler (https://compiler.toolaska.com) is secure client-side code execution:

  • 100% In-Browser Execution: All HTML, CSS, JavaScript, and TypeScript compilation and rendering runs entirely within the client's web browser using sandboxed browser execution environments.
  • Zero Server Uploads: No user-entered code snippets, scripts, tokens, or custom libraries are sent over the network to any server.
  • Zero Database Storage: We do not store, log, or persist user code snippets in any database or remote telemetry pipeline.
  • Isolated Execution: User scripts run in an isolated sandbox preventing unauthorized access to external origins.

🛡️ Reporting a Vulnerability

If you discover a security vulnerability or potential sandbox bypass concern in Toolaska Quick Compiler, please report it responsibly so we can address it promptly.

How to Report:

  • Email: Send vulnerability reports directly to info@toolaska.com.
  • Please do not open public GitHub issues for sensitive security vulnerabilities.

What to Include:

  • A clear description of the vulnerability.
  • Steps to reproduce or proof of concept snippet.
  • Affected browser versions or operating systems.

We take security seriously and appreciate the developer community's efforts in keeping our tools safe.

There aren't any published security advisories