Security · browser-native delivery

A website should ask for less ambient authority.

Ratdolt delivers Reader, Composer, Research and Library from its own web origin. It does not require an extension that can inspect unrelated tabs, browsing history or source-site cookies. That removes one permission class; it does not make the website, its accounts or its software supply chain risk-free.

Security contract reviewed August 16, 2026

What the website can access

Public URL intake. Ratdolt contacts the public address you submit through a server-side network and content-safety boundary. It does not receive your browser's source-site session.
Deliberate selected content. Select to Read accepts only text or saved HTML/MHTML/MHT/Safari WebArchive you choose. It decodes one declared MHTML root or one WebArchive main HTML resource and ignores attachments, subresources and subframes; active elements, credentials, page scripts, hidden controls and source URLs embedded in rich markup are discarded before the closed semantic payload is submitted.
Local documents. A PDF stays in the current browser by default. Account storage requires a separate explicit cloud-save action; local passwords are neither transmitted nor persisted.
Optional installation. Installing the web app may add a dedicated window and Share Target. It keeps the same origin and same capabilities; it does not gain extension-style access to other tabs.

Delivery controls

Server authorization validates the current account instead of trusting a browser session claim, and provider connections remain separate from social sign-in.
Responses suppress referrers, reject content-type guessing, deny unused camera, microphone, geolocation, payment and USB capabilities, and prevent ordinary Ratdolt pages from being framed by another origin.
Only explicit public profile and collection embed routes allow a cross-origin ancestor. The public offline article shell permits a same-origin ancestor solely so Safari can render its inert local Blob; external framing remains denied. Embed profile, object, collection and file visibility gates still run on every request.
The root-scoped service worker stores public offline shells and versioned public assets only. It never caches responses from sessions, APIs, authentication, Account, Billing, Composer, Library, local PDF, Research, embeds, Select to Read or shared capability routes.
Portable HTML is inert and scriptless; private archive responses use sandboxed deny-by-default content policy. External preview media receives no request until a reader chooses it.

Report a vulnerability responsibly

Email get@ratdolt.com with “Ratdolt security report” in the subject. Include the affected Ratdolt route, impact, the smallest reproducible sequence and a safe proof. The machine-readable contact and its fixed expiry are at /.well-known/security.txt.

Do not include passwords, provider tokens, complete payment details, private document bodies or another person's personal data.
Do not degrade availability, automate high-volume requests, persist access, alter or delete data, or use social engineering. Stop after the minimum proof and report it.
Use an account and content you control. A public disclosure policy is not authorization to access another account or to act outside applicable law.
Ratdolt currently promises neither a bounty nor a fixed reward. Acknowledgment, remediation and coordinated disclosure timing depend on verified impact and operational capacity.

Known boundary

Browser-native delivery reduces ambient permissions and makes the deployed origin inspectable, but the browser, hosting platform, package graph, identity provider, email provider and payment provider remain separate trust boundaries. Ratdolt does not market “no extension” as “no security risk.” See the Privacy Policy and Content Policy for data and acquisition limits.