Wireframes.online is a fully client-side application. Here's what that means for security:

• No backend server — All logic runs in the user's browser
• No user accounts — No authentication, no passwords stored
• No data transmission — Zero API calls, no analytics payloads, no third-party data sharing
• LocalStorage only — Saved prompts are stored exclusively in the user's browser localStorage
• No cookies — We do not set any cookies (including tracking cookies)

If you discover a security vulnerability in this project, please report it responsibly:

1. Do NOT open a public GitHub issue for security vulnerabilities
2. Email us at info@wireframes.online with:
   • A description of the vulnerability
   • Steps to reproduce
   • Potential impact
3. We will acknowledge receipt within 48 hours
4. We will work with you to understand and address the issue

Since this is a static, client-side application with no backend or user data processing, the attack surface is limited. However, we still take the following seriously:

• XSS vulnerabilities in user-editable prompt areas
• Dependency vulnerabilities in build-time npm packages
• Content injection through URL parameters or localStorage manipulation
• Supply chain attacks via compromised dependencies

• All user-generated content (custom notes, project names) is sanitized before DOM insertion
• Build dependencies are regularly audited
• No inline event handlers — all JavaScript is loaded from external files
• Content Security Policy headers are recommended for deployment

Our runtime has zero dependencies. Build-time dependencies are:

• html-minifier-terser — HTML minification
• javascript-obfuscator — JS obfuscation
• @types/bun — TypeScript definitions (dev only)

These are only used during the build process and are not shipped to end users.