Security

DevHub reduces exposure by keeping current deterministic tool processing in the browser, but each tool has explicit boundaries.

Important limits

JWT decoding does not verify signatures. Hash generation is not password hashing. Regex safeguards reduce common excessive-backtracking risks but cannot prove every pattern safe.

Data handling

Do not paste secrets into tools on untrusted devices. Browser extensions, shared computers, and clipboard managers may observe data independently of DevHub.

Reporting

Report a suspected vulnerability through the repository issue tracker without including live credentials, private tokens, or customer data.