DIRECT ANSWER / 14
What is the security model of this static review tool?
A restrictive content policy, local assets only, no runtime network, bounded parsers, rejection of formula intent in imported cells, escaped exports, safe archive paths, digest checks on restore and a single-writer lease.
Why this review exists
The tool opens files a reviewer received from somebody else, which makes untrusted input the central concern.
Handling untrusted input
Imported delimited text is parsed with bounded row and size limits, and cells carrying spreadsheet formula intent are rejected rather than evaluated. Nothing is committed until a person has previewed the table and mapped the columns.
Narrative text is treated as text. There is no HTML rendering of imported prose, no remote resource loading and no rich-format parser, which removes the largest class of document-parsing vulnerability by not having the feature.
Generated exports escape user text, archive entry paths are constrained so a packet cannot write outside its own directory, and checkpoint restore verifies the SHA-256 digest over the payload before anything is applied.
The browser session
A single-writer lease keeps a second tab in the same browser from silently overwriting the first, and the tab that has lost it says so rather than discarding work.
The content policy allows only same-origin scripts, styles and images, and the runtime makes no cross-origin request at all.
None of this is a certification, an audit or a penetration test, and the largest remaining risk is the device the review lives on.
Practical sequence
- Preview every import before committing it
- Verify a checkpoint's digest before relying on it
- Verify the packet checksums with your own tool
- Keep the review on a device you control
What remains outside the app
Grantweft performs arithmetic and textual cross-reference on user-supplied material. It does not write proposals or determine eligibility, allowability, accounting treatment, compliance, completeness, accuracy, submission readiness or funding outcome.
The private desk keeps exact source labels, stable budget row identities, paragraph-based claims, confirmed mappings, visible arithmetic, findings, human decisions, review freezes and passive handoff files connected without an account or remote application database.