Please open a GitHub security advisory or a minimal issue that uses synthetic data. Do not paste private production datasets into an issue.

The production modules contain no dataset upload endpoint, account system, telemetry call, or third-party chart runtime. Local processing does not make a public share link or exported chart confidential; inspect files before sharing.

Labels are written with text nodes rather than injected HTML, table and project sizes are bounded, control and bidirectional formatting characters are rejected, and downloaded CSV cells beginning with spreadsheet formulas are neutralized.