The main risks in a tool like this are a hostile input file, an export that executes something when opened, and a stale cached application. Each is addressed directly, and none of them is addressed by a server, because there is not one.

Hostile input

Parsing is strict and bounded. Malformed quoting, ragged rows, duplicate headers, and files beyond the configured byte, row, column, cell, and text limits are refused rather than repaired, so a crafted file cannot push the parser into an unbounded state. Headers that would be unsafe in a spreadsheet are rejected at intake.

Export safety

Every value written to a CSV register is escaped, and any value beginning with a spreadsheet formula character is neutralised so that opening a register cannot execute a formula. The review packet contains no scripts, no remote assets, and no active content of any kind.

Application integrity

The delivered pages set a restrictive content security policy: scripts and styles only from this origin, no connections, no framing, no plugins. The service worker precaches a fixed shell list under a build-stamped cache version, so a new build replaces the old cache instead of leaving a half-updated application behind.

Worked example

Load a candidate whose header row contains a duplicate column name. Intake refuses it and names the duplicate rather than silently keeping the last occurrence. That refusal is the security control and the useful review finding at the same time: a producer emitting duplicate headers has a pipeline problem worth raising.

Method and limits

This model covers the application. It does not cover your browser, your operating system, your extensions, or the people with access to your machine. A browser extension with permission to read page content can read anything you load here, and no in-page control changes that. There is no authentication, so anybody with access to the browser profile has access to the project.

Do this in the app

Open the workbench and use the Settings view to reset local data before handing a shared machine to somebody else.

Related reading