Security

Security is part of the product, not a badge.

Tolvix is a static browser application with no user account database or login. The main attack surface is browser code, third-party dependencies, and hosting configuration, so the security model focuses on those areas.

Static application

No application user-account database.

HTTPS deployment

CSP, HSTS, frame, and permission controls are configured for production.

Version-pinned code

Advanced libraries use explicit versions rather than floating latest URLs.

Browser security controls prepared for deployment

Content Security PolicyRestricts script, worker, media, and network sources; inline event-handler scripts are blocked.
HTTPS + HSTSThe deployment configuration requires HTTPS and sends Strict-Transport-Security on compatible production hosting.
Clickjacking protectionframe-ancestors none and X-Frame-Options: DENY prevent other sites from embedding Tolvix pages in frames.
Permissions PolicyCamera and microphone are limited to same-origin pages; geolocation, payment, USB, serial, Bluetooth, and browsing topics are disabled.
MIME and referrerX-Content-Type-Options: nosniff and Referrer-Policy: no-referrer reduce unnecessary browser exposure.
Cross-origin controlsCOOP/CORP and Origin-Agent-Cluster reduce unintended cross-origin context sharing.

Third-party code

Advanced media conversion uses @ffmpeg/ffmpeg 0.12.10 and @ffmpeg/core 0.12.10; PDF uses pdf-lib 1.17.1; QR uses davidshimjs-qrcodejs 0.0.2. Versions are pinned. A fallback CDN is used for availability, so the site should be served over HTTPS.

Security limitations

Client-side processing does not make a site invulnerable. Browser bugs, vulnerable dependencies, malicious files, and device-memory limits remain possible. Verify important outputs.

Report a vulnerability

Use the verified launch contact with the affected URL, browser, reproduction steps and observed impact. Do not include other people’s private data.

alextopmanager@gmail.com

Privacy →Contact →

Reviewed August 10, 2026.