What stays in your browser

The SBOM checker reads the file you choose, or the JSON you paste, in your browser and inspects it there. The document and its report are not sent to a server. The report stays in the page’s memory until you clear it or leave the page. If you let an AI agent in your browser use the checker’s tool (WebMCP), the agent supplies the document and receives the report, under the agent’s own terms.

The browser labs run your code in a sandbox inside your browser, and the code is not sent to a server. Reports, practice records, exported drafts, exported progress and Download my work are created in your browser and saved as files on your device. Download my work fetches the lab’s exercise files from this site and adds your code to them in the browser.

What the host can see

The hosting provider receives every request your browser makes to this site, with the ordinary request metadata: your IP address, the address requested, the time, your browser’s user agent and, within this site, the page you came from.

Search runs in your browser, but it does not hide what you search for from the host. When you first use search, the page downloads a search index from this site. As you type, it downloads the parts of the full-text index and the result summaries it needs, and which files those are depends on the words you search for and the pages they match. The host’s request logs can therefore show roughly what you searched for and which results you were shown, though not the exact text you typed.

So that a search can be bookmarked or shared, the address shows it (for example /search/?q=csrf, or ?q=csrf on the page under the search dialog). Closing the search dialog removes it. While it is in the address, the search travels with it: your browser sends that address to the host as the referring page when you open a result, and the host receives it if you reload, bookmark or share the address.

In Chrome and Edge, when your pointer rests on a link to another page of this site, the browser may fetch that page in advance so that it opens at once. The host can therefore receive requests for pages you did not open.

What is stored on your device

The site sets no cookies. It keeps these entries in your browser’s local storage for this site:

  • ss-theme: light or dark, when you choose one in the theme switch. Choosing System removes it.
  • ss-learning-v1: the IDs of the guides, labs, projects and learning path items you mark complete. If stored progress cannot be read, a copy is kept in ss-learning-unreadable so that it is not lost.
  • ss-lab-mode: your Guided or Challenge choice for the labs.
  • ss-lab-unlocks: and the lab’s name: in Challenge mode, how many of your runs failed and whether you changed the starter code, which decide when hints and the reference solution unlock.
  • ss-stage: and the lab’s name: the first-stage input that made the starter break its rule, once you find one.
  • ss-draft:workshop- and the lab’s name: your lab code, saved as you type.
  • ss-draft: and the exercise’s name: notes or code in the other exercises, such as capstones and practice records, only after you choose Save draft on this device. Later edits are then saved as you type.

Delete a saved draft with its Delete saved draft control. Learning progress can be exported, imported or reset from the learning pages. Clearing this site’s data in your browser’s settings removes all of it. This storage is not encrypted by the site and can be read by anyone, and any software, with access to the same browser profile.

Third parties

Pages load their fonts, scripts, styles, images and search index only from this site, and the Content Security Policy blocks anything from elsewhere. The site has no analytics, advertising, user accounts, mailing lists or embedded third-party content. Use synthetic data when you try the tools and exercises.

One tool sends data elsewhere, and only when you ask it to. The OSV dependency lookup reads your lockfile or SBOM in your browser and shows you the exact request first. When you press Send, it sends the ecosystem, name and version of each package you left in the request to OSV.dev (api.osv.dev), then fetches the advisory records OSV names by their IDs. If you then choose to add EPSS scores, it sends the CVE IDs from the report to FIRST (api.first.org). These requests carry no cookies and no referring page, but like any request they show those services your IP address and browser. That page’s Content Security Policy allows those two services and no others; every other page may connect only to this site.

Following a source link takes you to another website under its own policies. Your browser tells it only that you came from this site, not which page.

Hosting and contact

The hosting provider processes the request metadata described above under its own policies. See the hosting provider’s privacy policy, and contact admin@softwaresecurity.com with questions about the site.