Architecture
Data work runs in dedicated browser workers. Cells render as text, formulas are never executed, exports detect spreadsheet injection risks, and advanced dependencies are self-hosted.
Boundaries
The tool is not an antivirus or universal sanitizer. Malicious or unusually large documents can still exhaust browser resources. Safety limits refuse encrypted workbooks, giant cells, excessive columns and deeply nested JSON.
Report a vulnerability
Follow the instructions in /.well-known/security.txt. Never attach confidential customer files; use a minimal synthetic example and a redacted diagnostic.