Security fixes are applied to the latest release on the default branch.

Use GitHub's private vulnerability-reporting feature for the repository. Do not open a public issue containing an exploit, a private dataset, credentials, or personal information.

Please include the affected file, the smallest safe reproduction, impact, and the browser involved. A report is not a request to test the live website with real or private data.

• Input is parsed and rendered in the current browser tab.
• The visualization runtime has no dataset upload or telemetry endpoint.
• User-controlled labels are inserted with DOM text APIs, not HTML parsing.
• Table and project inputs have a 2 MB safety limit.
• Labels reject control and bidirectional override characters.
• Spreadsheet-like CSV exports neutralize formula-leading cells.

No review can prove that software has zero vulnerabilities. The current tests and review record describe the checked scope and known limits.