ChronosResearch processes user CSVs in memory and does not require credentials, fetch arbitrary URLs, execute uploaded content, or persist imported data. Request bodies are bounded before parsing, schemas reject unknown fields, validation responses omit raw inputs, and the browser renders data as text. A restrictive script policy and no-store responses reduce browser exposure.

Run on 127.0.0.1. Internet deployment needs authenticated access, TLS, proxy request/time/rate limits and monitoring. This v1 has no user accounts, shared data store, rate limiter, or multi-tenant resource isolation. Do not expose it as a public compute service without those controls. JSON exports contain the imported CSV; manage them like the original data.

Report suspected vulnerabilities privately through GitHub's security reporting when available; do not publish private data or credentials in issues. Pinned dependencies are audited during release, but require ongoing updates.