Method note 14
What is the security model of this static review tool?
A restrictive content policy, local assets only, billing-only runtime network, bounded parsers, rejection of formula intent in imported cells, escaped exports, safe archive paths, digest checks on restore and a single-writer lease.
Why this review exists
The tool opens files a reviewer received from somebody else, which makes untrusted input the central concern.
Handling untrusted input
Imported delimited text is parsed with bounded row and size limits, and cells carrying spreadsheet formula intent are rejected rather than evaluated. Nothing is committed until a person has previewed the table and mapped the columns.
Narrative text is treated as text. There is no HTML rendering of imported prose, no remote resource loading and no rich-format parser, which removes the largest class of document-parsing vulnerability by not having the feature.
Generated exports escape user text, archive entry paths are constrained so a packet cannot write outside its own directory, and checkpoint restore verifies the SHA-256 digest over the payload before anything is applied.
The browser session
A single-writer lease keeps a second tab in the same browser from silently overwriting the first, and the tab that has lost it says so rather than discarding work.
The workspace uses local assets and permits only RevenueCat entitlement checks. Premium and restore pages additionally permit the documented billing providers; no proposal data is sent.
None of this is a certification, an audit or a penetration test, and the largest remaining risk is the device the review lives on.
A shared or unlocked machine exposes the review to anyone who opens the browser profile, so keep the desk on a device you control and keep the digest-backed checkpoint somewhere you would keep the proposal itself.
Practical sequence
- Preview every import before committing it
- Verify a checkpoint's digest before relying on it
- Verify the packet checksums with your own tool
- Keep the review on a device you control