Security

The shape of the system

The most useful thing we can tell you about ToolZool’s security is what it does not have.

• No file uploads. Your files are processed in your browser. There is no upload endpoint, so there is no store of user files to breach.
• No accounts. No usernames, no passwords, no sessions, no password database.
• No application database. The site is generated as static files at build time. There is no query for an attacker to inject into.
• No server-side application code. Pages are files served by a CDN.

Most of the incidents that affect sites in this category — leaked file stores, credential dumps, injection through an upload handler — are not possible here because the component that would fail does not exist. That is a deliberate architectural choice, not an accident of scale.

Transport

The site is served over HTTPS only. Plain HTTP requests are redirected. HTTP Strict Transport Security is enabled, so a browser that has visited once will refuse to connect insecurely afterwards.

Content security

Pages ship a Content Security Policy that restricts scripts, styles, images and fonts to our own origin. There are no third-party scripts, no external font hosts, no analytics and no advertising code on any page, so there is no third-party origin that could compromise a page by compromising itself.

Dependencies

The site is built from a small set of open-source packages, pinned to specific versions and updated deliberately rather than automatically. Build and deployment run in a hosted CI pipeline with credentials held as encrypted secrets, never in source.

What we cannot protect you from

Honesty is more useful than reassurance here.

• Your device. If your machine is compromised, code running in your browser is compromised too. Nothing we do changes that.
• Browser extensions. An extension with permission to read page content can read anything on the page, including a file you have opened in a tool.
• A malicious copy of this site. Check that the address bar reads toolzool.com. We will never ask you to install anything, disable a security feature, or enter a password.

Reporting a vulnerability

If you find a security issue, please report it privately before disclosing it publicly, and give us a reasonable opportunity to fix it.

Useful reports include what you found, how to reproduce it, and what an attacker could achieve. We will confirm receipt, keep you updated, and credit you if you would like to be credited.

We do not currently run a paid bug bounty. We do take reports seriously, and we would rather hear from you.