MagViz is early-stage research software. Fixes land on main and go out in the next release; there are no long-term support branches.

Report privately through GitHub's security advisory form. Please do not open a public issue for a suspected vulnerability.

Include what you have: affected version, browser, a description, and a reproduction if one exists. Expect an acknowledgement within about a week — this is a single-maintainer scientific project, not a staffed security team.

MagViz is a static client-side application. It has no server, no accounts, no credentials, and no network calls beyond fetching its own assets. Data you open is parsed in your browser and is never uploaded anywhere.

The realistic threat is therefore a malicious or malformed input file — an HDF5 dataset, scene JSON, or theme TOML that causes a crash, unbounded memory growth, or script injection when parsed and rendered. Reports of that kind are in scope and welcome, as is anything that lets untrusted file content escape into the DOM.

Out of scope:

• Vulnerabilities in dependencies, unless MagViz's own use of the dependency is what makes them exploitable. Report those upstream (three, jsfive, uplot, smol-toml, stats-gl).
• Self-inflicted data loading. Opening a file you do not trust is equivalent to running it; the browser sandbox is the boundary, and MagViz does not add one on top.
• The bundled sample datasets. They are documented in data/README.md and are static scientific data, not executable content.