icebergsim-dataExplorer is a client-only, local-first application. There is no backend and no network service operated by this project:

• All parsing, pivoting, and storage happen in the user's browser.
• Imported files never leave the device; data is stored only in the browser's own IndexedDB.
• The only network activity is fetching the static assets, and — on demand — the WebR WebAssembly runtime when a user opens an .rds/.RData file.

As a result the security surface is primarily: the client-side handling of untrusted file input (a malicious spreadsheet/CSV/JSON/R file), and the third-party dependencies bundled into the app.

This project is pre-1.0; security fixes are applied to the latest main and the most recent release.

Please do not open a public issue for security vulnerabilities.

Report privately using GitHub's built-in flow:

1. Go to the repository's Security tab.
2. Choose Report a vulnerability (private vulnerability reporting).

If that is unavailable, contact the maintainer via GitHub (@ebergel) and request a private channel.

Please include:

• A description of the issue and its impact.
• Steps to reproduce (a minimal sample file is ideal, since most surface area is file parsing).
• The browser and version, and the app version/commit.

You can expect an acknowledgement within a reasonable time. Once a fix is prepared, we will coordinate disclosure and credit you if you wish.