Security and privacy
Privacy
Section titled “Privacy”Developer Assistance Tools runs entirely in the browser. There is no backend, no account and no user-data store; each tool does its work on your machine, and no tool input ever leaves the browser. It is a static site deployed on Cloudflare Pages.
Usage counts. The online version at celesbox.com counts anonymous page views with Cloudflare Web Analytics. It sets no cookies and collects no personal data: it sees which page was opened (so which tool), the referring site, the country, the browser type and page load timings, and never anything you type, paste or open in a tool. The offline package, the container image and every self-hosted copy contain no analytics or tracking at all, and their pages refuse every request to another server.
Protections
Section titled “Protections”- Content-Security-Policy. Pages use
default-src 'self'andconnect-src 'self'along with the other fetch directives, so a buggy tool or a library that phones home cannot send requests to another host withfetch, XMLHttpRequest, WebSocket, EventSource,sendBeacon, images, fonts, media, frames or form posts. The one exception is the online site at celesbox.com, whose policy also allows the Cloudflare Web Analytics script and its report address; builds for offline and self-hosted use do not. - Runtime egress guard. A second layer (
js/core/egress-guard.js) refuses those request APIs, and WebRTC and WebTransport, in the page itself. - Sandboxing. Code you write in the JS Playground and HTML Viewer runs in sandboxed iframes with an opaque origin. Rendered HTML and Markdown pass through DOMPurify.
- Integrity. Every build publishes a SHA-256 manifest of its files (
offline-manifest.json), and the self-hosted package carriesSHA256SUMS.
These protections are enforced in code and checked by the project’s test suite.
Limits and residual risks
Section titled “Limits and residual risks”The project does not claim to be unhackable. The security policy states these residual risks:
- Most pages run under a strict CSP: scripts from this origin only, no inline script and no eval. Notepad keeps eval for its JavaScript syntax check, which compiles your text without running it. Three places keep
'unsafe-inline'and'unsafe-eval'because they cannot work without them: draw.io, the JavaScript Playground and the HTML Viewer. A cross-site-scripting bug on one of those pages could run in the page, and since the tools share one origin it could read that origin’s local storage and IndexedDB. - The CSP and the egress guard stop request APIs, not navigation. Script already running on the origin could send data away by moving the tab, or opening a window, to another site with the data in the address. No browser offers a policy that blocks that.
- Background workers (the SQL engine, the JAR decompiler, the regex tester) are scripts from this origin served without a CSP of their own; they run only the site’s own code and its vendored libraries.
- Vendored libraries may carry their own vulnerabilities. They are pinned and listed in
THIRD-PARTY-NOTICES.txt.
An independent penetration test is recommended before relying on this software in a high-assurance setting.
Self-hosted copies
Section titled “Self-hosted copies”The self-hosted image sends the same security headers as the public site, stores nothing on the server, contains no analytics, and does not need outbound network access. See Self-hosting.
Reporting a vulnerability
Section titled “Reporting a vulnerability”Report security issues privately by email to security@celesbox.com. Include steps to reproduce, the affected tool or file, and the impact. The project aims to acknowledge a report within a few business days, and asks for reasonable time to fix an issue before it is disclosed publicly.