How the zero-upload treasury design can be verified.

Data flow

No step in this path requires a request body, cloud object store, server database, server action, Pages Function, or Cloudflare Worker. Optional saved cases use only this browser's IndexedDB after an explicit action.

Browser-enforced boundaries

• A route-specific Content Security Policy allows self-hosted application assets and local Blob workers/downloads while blocking third-party scripts, object embeds, framing, camera, microphone, location, payment, and USB access.
• Treasury parser dependencies are bundled at build time and served from Lucaden; the tools do not import code from a third-party CDN at runtime.
• XML parsers reject DOCTYPE and entity declarations. Malformed financial rows stop the complete conversion rather than disappearing from partial output.
• Downloads use Blob and URL.createObjectURL, then revoke the temporary URL.

Verify it yourself

1. Open browser developer tools and select the Network panel.
2. Clear existing requests, then choose and process a test fixture in a treasury tool.
3. Inspect request payloads: no request contains the file, filename, size, parsed values, or output.
4. Use a synthetic fixture rather than a live bank file when testing a new device or browser.

Dependency choices and rejected candidates are recorded in docs/DEPENDENCIES.md; redistributable notices are published in THIRD_PARTY_NOTICES.txt.

Report a security issue

Email security@lucaden.com with reproduction steps and a synthetic sample. Do not send credentials, production payment files, or personal bank data.