Browser scanner
When you choose a file, the browser reads its bytes and transfers them to a dedicated local worker. Findings are returned to the page in memory. The file and report are not intentionally stored after you close or reload the page.
The page’s Content Security Policy sets connect-src 'none'. The shipped application contains no code that sends file content or report content to a server.
Hosting logs
The static site may be hosted by GitHub Pages. Like most web hosts, GitHub may receive ordinary request information when your browser downloads the public page files, such as your IP address and requested URL. Safe to Send does not receive the document you inspect through those requests.
CLI
The CLI reads local files, computes a local report, and writes only where you direct it. It makes no network request. Package installation is a separate network operation performed by npm or Git.
Exported reports
Reports can contain excerpts of hidden material, file paths, names, comments, URLs, or redacted credential fragments. Protect exported reports as carefully as the underlying document.
Verification
The code is available for inspection. Network use can also be verified in browser developer tools: after the static page has loaded, scanning should create no network request.
Changes
If a future version adds an optional network feature, it must be disabled by default, clearly disclosed before use, isolated from the local scanner, and documented in this page and the changelog.