Security
What runs in your browser
Your saved chats and library are encrypted by JavaScript in your browser, and PII removal and connected-service tokens are handled there too: the server keeps your vault only as ciphertext and never sees your vault passphrase or a connector's token. (Scheduled tasks are the exception: they are stored as text so they can run while you are away.) But a website's JavaScript comes from its server each time you open a page, so a changed server could send changed code. The desktop app is the stronger option: its code is fixed when you install the signed app.
To check what your browser ran, compare a script's SHA-256 with this list for the version you used, for example curl -s https://vulcanveil.com/static/chat/vault.js | sha256sum. The list changes when a new version is deployed.
Page scripts in this version
| File | SHA-256 | Bytes |
|---|---|---|
/static/chat/chat.js | 01928a0596bf47368334199dc8ab76d1c358bd713fda5f19d525c1495dc3704e | 118,462 |
/static/chat/files.js | 35b27c32f216380c779a239185b8cc981c5cc9654d4464c4dc50d72c0b562c0b | 15,570 |
/static/chat/maps.js | e442ebfd47353744604271339937c6bfaae7a0c400615012ef272f1fcaef9a56 | 2,767 |
/static/chat/markdown.js | 2d162ebd2d75350a5688e8f6468a37fa6389ff5db0804ba170a2c3be4300cbc6 | 16,207 |
/static/chat/panels.js | 4c54314d4ed380f5aa69814c61c6769124c18f3123299d3be93bf6c6e0baf0fd | 21,772 |
/static/chat/python.js | de80136ffffbec995be894989881af78c73a69c276d5a687a5158502c4aaa6a0 | 3,229 |
/static/chat/sites.js | 79b5271393e4295bf73a202d9edc9d5e6965e5acfbeed42b8cbacfc708d93b08 | 6,526 |
/static/chat/vault.js | e8225b0c1ec8c9f576cec3db1dd857c79d996841d9b7cf8dea8922c190c610d7 | 10,905 |
/static/library/convert.js | a3e5d1a798be0b020a079710289add12d12a2c344eecae3539f0362974f514da | 31,730 |
/static/library/core.js | 6437ad5407f30524e7cc434d61bae39f72cde0a4af0ccbae11bd33d71209ce44 | 12,838 |
/static/library/main.js | ed1c44ca1411d1d0d7a269d4bd239390deaa2bfc70b1acfc920f9630c05d90e6 | 6,792 |
/static/library/store.js | 49df1decebde23b26ab5d117fef650192c8ce4424f57bf1e97200fe9633a1a3e | 33,085 |
/static/library/view.js | dcb0a4786b350f77e2fe2c820422ba784efdb13d6c835e19a404c4ba8c99adda | 32,143 |
/static/library/viewer.js | 9dff19e94fb3245b43765ef75c470a5a57aefe192624a75ecc8cafbb9477a2c2 | 10,919 |
/static/library/zip.js | 8b13ccd945be070bb97fcf1c5daf122fb25cad6adc117218e6317b343849a052 | 4,865 |
/static/pii/pii.js | 02f7e86d85a1048e88dc290ded7b6338bbca592f652500fe150754cb581bff4f | 28,401 |
/static/pii/rules.js | fe876c6221b3d704bb542393fa1380a6c529bc5f071f1dcd67f8fd349526e67d | 8,389 |
/static/pii/tokenizer.js | cd2869bcb696fd66116e514f289c0ff3e3747d5de17122ad42558fb7d0ae1039 | 5,059 |
/static/pii/ui.js | ef8b895630fe290d98db1476fc76acd329f2c1351990f3ad13f1c5b085283a69 | 2,909 |
/static/pii/worker.js | d5254e8bd77ad57a03479a651deadecf1914449d36b8cb3a7c560b30719f8560 | 10,592 |
/static/connectors/connectors.js | c1e385383e46b5dd8b4e733d39e8b33427d1968558dd00b0c406e8bc6b115993 | 5,526 |
/static/connectors/github.js | 1162568cfeeda94b54276a45e4f23c7c3cc5ddeeaffac7ea3e7c62ad95a5df25 | 8,695 |
/static/connectors/panel.js | 7638d2f3bdecf251808cde7a6d60d931c46cc2c918c4de13afb7595d905d7549 | 10,106 |
/static/sandbox/frame.js | fcb0cdebdacd912f33c3cbe76ca6d4059e452272d19b304c399e136c338323b5 | 17,271 |
/static/sandbox/map-page.js | 5357e33a140ece16124d75de8e59fefc4c812e22c74cf8a7f1a8d3ed87eae755 | 9,079 |
/static/sandbox/map.js | cfc547f3573c12e1e50ac2e405adf0816853ee00c2ed8b506cf013fe9d0e27ea | 4,505 |
/static/tasks/tasks.js | b80f15c109db36b15563e4c8b9392e675aa084d19bc5caf90cd9e43a99c352c3 | 6,186 |
Third-party code and the PII model
Served from this site, never from elsewhere, at pinned versions: pdf.js 6.3.289, Pyodide 0.27.7, folium 0.20.0, onnxruntime-web 1.30.0.
The PII model is gravitee-io/bert-small-pii-detection (Apache-2.0, revision f8c27a85c51c), quantized to int8 when the site is built from the publisher's file (SHA-256 5fc1642b7400e18ee6014571dc6ae88a7bd155389334b9fa76fbc368d2c7c493). The quantized file is 6823668ae77026167efc212e3abf8d1f9bc302ae6a09a7b27a9830febaee0b62; your browser checks it against this before using it.