Understand website security and report a vulnerability

Browser-native authority

Ratdolt can process a public URL or content you deliberately provide. It cannot inspect unrelated tabs, source-site cookies or browsing history, and installing the website does not grant extension-style permissions.

Response and offline boundaries

Ordinary documents deny cross-origin framing, unused camera, microphone, geolocation, payment and USB capabilities, object embedding and foreign base URLs. Public embed routes relax only their frame-ancestor rule. The service worker stores public shells and versioned assets, not sessions, APIs or private product routes.

Responsible report

Use the expiring RFC 9116 contact at /.well-known/security.txt or email Ratdolt with the affected route, impact, smallest reproducible sequence and safe proof.

1. Test only accounts and content you control.
2. Stop at the minimum proof; do not retain access, alter data or degrade availability.
3. Exclude passwords, tokens, payment details, private document bodies and another person's personal data.