Under the Hood: The Architecture of CSP evaluator
Policies mention your CDNs and reporting endpoints. Do not paste them into a third-party scanner if you can avoid it.
A CSP evaluator splits directives and looks for known-unsafe tokens. It does not execute the policy in Chrome. There is no origin fetch and no upload route. Inputs are strings, JSON, or File objects decoded with the platform APIs in this tab.
Memory Allocation & Browser Threading Mechanics
Work stays on the main thread because typical pastes are kilobytes, not gigabytes. useMemo or an explicit button recomputes a derived string. Image tools downsample onto a canvas so pixel loops stay bounded. Crypto uses SubtleCrypto, which returns ArrayBuffers the engine can recycle after you copy the result.
Algorithmic Deep-Dive: Code Snippet & Logical Analysis
// csp-evaluator — parse input in the tab, emit a string, never fetch().
Treat the snippet as the contract: deterministic in, deterministic out. Invalid input should surface a string error, not a thrown render.
The Local Storage Sandbox & Volatile Data Pipelines
Default is React state only. Object URLs from canvases or downloads are revoked after click when the island uses URL.createObjectURL. There is no “recent jobs” IndexedDB. Close the tab to drop secrets (JWT HMAC keys, TOTP seeds, VAPID private JWK).
Verifying True Privacy: How to Audit Your Browser's Network Tab
F12 → Network → clear. Run the tool with a canary string such as TWA_CANARY_TOKEN. Filter Fetch/XHR. The canary must not appear in any request payload. Ads and analytics on the shell are unrelated to the island; they must not receive File bytes.