If you discover a security vulnerability, please do not open a public issue.

Instead, email the project maintainer directly. You should receive a response within 48 hours. We will work with you to understand the scope and coordinate a fix and disclosure timeline.

The following areas are within scope:

• WASM sandbox escapes
• Input validation bypasses in SQL tokenizer
• XSS vectors in HTML editor
• Memory safety issues in Rust/WASM code

• Issues already documented as known limitations
• Theoretical attacks requiring physical access
• Issues in dependencies (please report upstream)

The sql_formatter project follows these security principles:

1. Browser-local by default: All SQL processing happens in-browser via WASM. No data leaves the client.

2. No code execution from SQL input: The tokenizer only classifies tokens; it never executes SQL. All output is generated by the formatter from token streams.

3. CSP-ready: The static editor generates no inline scripts from user content. Syntax highlighting uses CSS classes, not inline styles or innerHTML from user input.

4. Single-threaded WASM: The WASM module runs on the main thread with no shared memory, no workers, and no network access.