🛡️ Security & Privacy Audit

DevOmniToolsSecurity Audit Report

Audit Date 2026-09-19
Version v2.6.0

This document provides verifiable, technical proof of DevOmniTools' privacy and security architecture. Every claim is backed by observable evidence that you can independently verify in your browser's Developer Tools.

6
VERIFIED
1
IMPLEMENTED
1
MONITORED
0
FAILED
🔐

100% Client-Side Processing

✓ VERIFIED

All tool computations execute exclusively in your browser's JavaScript runtime.

✓ Zero server-side API endpoints exist in the codebase.
✓ Astro generates 360+ fully static HTML files — no dynamic server rendering.
✓ All cryptographic operations use the browser's native Web Crypto API (window.crypto.subtle).
✓ AES encryption, bcrypt hashing, JWT decoding — all execute in your browser tab's memory.
✓ When you close the tab, your data is immediately garbage-collected by the browser.

Technical Note: Architecture: Astro SSG → Cloudflare Pages CDN. Output: static HTML/CSS/JS. No Node.js runtime at serving time.

📋

Zero Server-Side Data Logging

✓ VERIFIED

Your tool inputs (passwords, keys, code, files) are never transmitted to any server.

✓ No server-side request handlers process tool inputs.
✓ Cloudflare Pages only serves static assets — it cannot read form inputs.
✓ Network tab in browser DevTools: no POST/PUT requests are made during tool usage.
✓ Cloudflare access logs contain only: timestamp, URL path, status code, and anonymised IP.
✓ Cloudflare's privacy policy prohibits them from reading file/form data from static sites.

Technical Note: Verifiable: Open DevTools → Network tab → use any tool → observe zero XHR/fetch calls to external endpoints.

🚫

Zero External Tracking Scripts

✓ VERIFIED

No Google Analytics, Google Tag Manager, Meta Pixel, Hotjar, or any third-party tracking.

✓ No <script> tags loading from google-analytics.com, googletagmanager.com, or similar.
✓ No beacon requests to analytics endpoints observable in network traffic.
✓ No third-party cookies set beyond GDPR-consented functional essentials.
✓ No localStorage abuse for fingerprinting.
✓ All JavaScript is first-party, bundled by Astro at build time.

Technical Note: Verify: Run browser extension "uBlock Origin" or "Privacy Badger" — DevOmniTools generates zero tracking alerts.

🔤

Zero External Font Loading

✓ VERIFIED

No Google Fonts or external font CDN requests. Typography uses system font stacks.

✓ No @import url("https://fonts.googleapis.com/...") in any CSS file.
✓ No <link rel="preconnect" href="https://fonts.gstatic.com"> in HTML.
✓ Font stack: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial.
✓ Zero external IP disclosure via font loading.
✓ No DNS prefetch to Google Fonts or Adobe Fonts CDNs.

Technical Note: Every Google Fonts request leaks your IP address to Google. DevOmniTools eliminates this vector entirely.

🛡️

Content Security Policy (CSP)

✓ IMPLEMENTED

CSP headers prevent XSS attacks and restrict resource loading to trusted first-party origins.

✓ Cloudflare Pages serves HTTP security headers on all responses.
✓ default-src 'self' — blocks all third-party resource loading by default.
✓ script-src 'self' — no inline scripts from external domains.
✓ img-src 'self' data: blob: — allows Data URI images (used by tool outputs).
✓ worker-src 'self' blob: — allows Service Worker and Web Workers.

Technical Note: Verify: curl -I https://www.devomnitools.com/en/ | grep -i content-security-policy

⚖️

GDPR & CCPA Compliance

✓ COMPLIANT

Full compliance with EU GDPR and California CCPA privacy regulations.

✓ Cookie consent banner shown on first visit — granular accept/reject controls.
✓ Functional cookies only used for dark/light mode preference and consent state.
✓ Privacy Policy documents all data handling (zero tool-input collection).
✓ Cookie Policy separately documents all cookies and their lifetimes.
✓ Data Processor: Cloudflare, Inc. (GDPR-compliant, EU Standard Contractual Clauses).

Technical Note: Privacy Policy: /en/privacy-policy/ | Cookie Policy: /en/cookie-policy/

📡

Offline PWA Security Model

✓ VERIFIED

Service Worker caches assets locally — tools work without any internet connection.

✓ Service Worker registered at /sw.js (v2.6.0).
✓ Cache strategy: Cache-First for static assets, Network-First for navigation.
✓ Offline fallback: /offline.html served when network and cache both miss.
✓ No background sync or push notifications — zero server communication required.
✓ Cache name versioned (omnitools-cache-v2.6.0) — old caches auto-purged on update.

Technical Note: Offline test: Enable DevTools → Network → Offline → all tools remain functional.

📦

Dependency Security

✓ MONITORED

All npm dependencies are audited. Runtime code is bundled at build time — no CDN script loading.

✓ npm audit run on every build in CI pipeline.
✓ No external CDN script tags (no unpkg.com, cdnjs.com, jsdelivr.net loading).
✓ Key runtime dependencies: bcryptjs (MIT), DOMPurify (Mozilla Public License), qrcode (MIT).
✓ DOMPurify used to sanitize all user HTML inputs before DOM insertion.
✓ All dependencies pinned in package-lock.json for reproducible builds.

Technical Note: Run: npm audit — expected 0 high/critical vulnerabilities.

🔬 Verify It Yourself — Independent Testing Guide

Network Inspector Test

  1. 1. Open any DevOmniTools tool
  2. 2. Press F12 → Network tab
  3. 3. Use the tool with real data
  4. 4. Observe: zero XHR/fetch requests to external domains

Offline Mode Test

  1. 1. Visit any tool page
  2. 2. Press F12 → Network tab → Offline
  3. 3. All tools continue to work
  4. 4. Confirms: no server dependency

Source Code Audit

  1. 1. Clone the GitHub repository
  2. 2. Search for: fetch(, XMLHttpRequest
  3. 3. All found instances call browser APIs or local data only
  4. 4. Zero calls to external endpoints

Security Headers Check

Run this curl command:

curl -I https://www.devomnitools.com/en/

Look for: Content-Security-Policy, X-Frame-Options

📬 Responsible Disclosure

If you discover a security vulnerability in DevOmniTools, please report it responsibly. We take all security reports seriously and will respond within 72 hours.

📧 Email: [email protected]
🐙 GitHub Issues: github.com/contactumairrana/omnitools

Scope: Please report vulnerabilities in the DevOmniTools web application only. Issues with Cloudflare infrastructure should be reported directly to Cloudflare. We do not offer a bug bounty program at this time, but we do credit responsible reporters in our changelog.