Security & Responsible Disclosure

Introduction

Devutilites is a free, client-side developer toolbox. Every tool runs entirely in your browser; the production site uses the same Next.js infrastructure you find on any modern SaaS, and we treat security reports accordingly.

In scope

• Cross-site scripting (XSS) in tool inputs or output rendering.
• Server-side request forgery (SSRF) in network-facing tools (REST Tester, Redirect Checker, DNS Lookup, SSL Checker).
• Open redirect via generated shareable URLs.
• Prototype pollution or untrusted deserialization in JSON, YAML, XML or INI formatters.
• Subdomain takeover, expired domain or dangling DNS records at *.devutilities.dev.
• Credentials or PII accidentally captured by the RUM endpoint (/api/track).

Out of scope

• Denial of service against Devutilites itself (we are static-hosted and rate-limited upstream).
• Vulnerabilities in third-party libraries we use (please file upstream with the maintainer).
• Cookies, fingerprinting or cross-site tracking (Devutilites does not use cookies).
• Theoretical issues that require an unlikely configuration to exploit.
• Issues reproducible only on browser versions we do not support.

How to report

Open a private security advisory on GitHub or email an encrypted report to collandev@gmail.com.

We aim to triage new reports within 48 hours on a best-effort basis. Critical issues are usually picked up within a few business days.

Thanks

Thank you for helping keep Devutilites and its users safe. We credit reporters in the changelog unless you ask us not to.