Security model

Last updated: 27 August 2026

Offline-first and self-contained

The whole reference is compiled into one static JSON file and searched in your browser. At runtime the app makes no external requests, so nothing about your session is exposed to any third party. connect-src in the Content-Security-Policy is limited to self.

Data provenance

The dataset is built from the official upstream repositories (GTFOBins and LOLBAS) by a transparent pipeline in the public repo. Every record links back to its source page so you can verify it — nothing is invented.

Hardening

• Nonce-based CSP with a fresh per-request nonce — no unsafe-inline in script-src, plus 'strict-dynamic'.
• object-src 'none', frame-ancestors 'none', base-uri 'self'.
• Strict headers: HSTS (preload), X-Frame-Options: DENY, nosniff, Referrer-Policy: no-referrer, COOP/CORP, locked-down Permissions-Policy.
• No third-party scripts, no cookies, no trackers.

Report an issue

security@0x6a03448f4d.com — see also /.well-known/security.txt.