Security boundary
Narrow claims. Testable controls.
Local tools process payloads in the browser. That does not make the browser invulnerable, prevent screenshots, or give web storage the same properties as a mobile OS keystore.
Protected by design
- No StackCache tool proxy
- No payload in URLs or analytics
- Cryptographic browser randomness
- Explicit destination before network actions
Outside the boundary
- Compromised browsers, devices, or extensions
- Screenshots and clipboard managers
- Data deliberately sent to another service
- Brief plaintext staging for a cold-start installed-app share
- Cleared browser profiles or lost vault passphrases
Network boundary
HTTP and MQTT traffic goes directly from your browser to the displayed destination. StackCache does not provide a proxy and cannot bypass CORS, TLS, mixed-content, forbidden-header, cookie, redirect, or certificate rules. The MQTT client accepts secure WebSocket endpoints only, disables the library's automatic reconnect and offline queue, and applies its own bounded reconnect policy. Request, response, message, and payload caps limit what the interface processes, but a hostile destination can still receive anything you deliberately send. Saved definitions and broker profiles are protected only while the browser vault is locked; an unlocked page, extension, browser, or device can access plaintext.
Share intake boundary
The installed-app target accepts declared text and URL fields only, stages one bounded item for no more than five minutes, and consumes it once. Opening a suggested local tool is always your explicit choice.
Report a vulnerability
Send a concise report to security@stackcache.app. Do not include real secrets or third-party personal data.