SECURITY ARCHITECTURE.
LAST AUDITED: SEPTEMBER 2026 · SECURITY STANDARD 2.0
Every tool executes inside your client browser sandboxed JavaScript engine. No payload data, uploaded images, or text strings ever reach a remote database.
Random generators, hashes, and UUIDs employ the hardware-backed Web Crypto API (crypto.getRandomValues) rather than pseudo-random math functions.
We maintain no server-side databases, no session recording tools, and zero marketing telemetry. Your sensitive code snippets and payloads stay private.
Enforced HTTPS with HSTS preloading, strict Content Security Policy (CSP), and restrictive HTTP security headers prevent cross-site scripting (XSS).
1. BROWSER SANDBOX & ZERO BACKEND PROCESSING
Most conventional online utilities upload your input files, passwords, or data blobs to an external server where backend microservices convert or compute the output. This pattern exposes user data to network interception, server compromise, and automated logging.
MustTools operates on a zero-backend execution philosophy. Tools like JSON formatters, Base64 encoders, Image compressors, and Regex testers run entirely within the native V8 / JavaScriptCore engine on your physical device. Your files never touch an external disk or cloud bucket.
2. CRYPTOGRAPHIC INTEGRITY
Tools requiring high randomness (such as the Password Generator, UUID v4 Generator, and Hash utilities) do not rely on standard pseudo-random functions like Math.random(), which are predictable and insecure for cryptographic use.
Instead, MustTools leverages the W3C standard Web Cryptography API (window.crypto.subtle and window.crypto.getRandomValues), tapping into OS-level entropy pools to guarantee non-deterministic outputs.
3. CONTENT SECURITY POLICY & NETWORK HEADERS
Every HTTP response served by MustTools includes strict defensive headers configured at both the origin reverse proxy and Cloudflare Edge:
- Content-Security-Policy (CSP): Restricts script execution to trusted first-party bundles, preventing inline evaluation and malicious script injection.
- Strict-Transport-Security (HSTS): Enforces modern TLS encryption with max-age=31536000 and includeSubDomains.
- X-Content-Type-Options: Configured to
nosniffto prevent MIME type sniffing vulnerabilities. - X-Frame-Options: Set to
DENYto eliminate clickjacking vectors. - Referrer-Policy: Set to
strict-origin-when-cross-originto eliminate leaking query params.
4. LOCAL STORAGE HYGIENE
MustTools does not store sensitive operational data, authentication tokens, API keys, or input histories in browser storage. The keys written to localStorage are strictly limited to UI state toggles:
| Key | Data Stored | Sensitivity |
|---|---|---|
| theme | 'light' | 'dark' | None (Public UI preference) |
| musttools_selected_country | ISO 2-letter Country Code (e.g., 'US') | None (Regional formatting preset) |
| musttools_geo_data | Cached Cloudflare country header | Low (Non-identifiable coarse geolocation) |
Users can purge all stored preferences at any time by clearing site data or utilizing private/incognito browsing windows.
5. VULNERABILITY DISCLOSURE PROGRAM
We welcome independent security researchers, ethical hackers, and developers to audit our platform. If you discover a security vulnerability, please report it responsibly:
Please include in your disclosure:
- Detailed steps to reproduce the issue.
- Proof of concept (PoC) code or HTTP request samples.
- Impact assessment and suggested remediation.
We commit to acknowledging reports within 48 hours and will not pursue legal action against researchers acting in good faith under standard coordinated vulnerability disclosure practices.