Pimp My IDE / garage dispatchBack to the garage
October 8, 2026 / browser tools / data custody

Local is a route, not a sticker.

A browser utility can read a file without uploading it. That claim becomes useful only when the page shows what enters, what runs, what leaves, and what the operator checked.

Inspect the network. Keep the input path visible.
LOCAL TOOL / CUSTOMS SCOPEPLAN ONLY
UNINSPECTED
InputProcessEgressReceipt

The browser can be the workbench.

The File API lets a page read files that a person selects through a file input or drag and drop. That mechanism does not require an upload. A page can also build an object URL for a selected file and use it for a preview. Long-lived tools should revoke object URLs when they no longer need them.[2]

SVG Spark applies that model to ten small utilities. Its public pages say processing stays in the browser. The collection includes vector conversion, PDF splitting and merging, JSON conversion, regular-expression inspection, SQL formatting, and contrast testing.[1]

"Runs in your browser" names a design. It does not prove the current build.

Test one output you can calculate.

We exercised SVG Spark's contrast checker with white and black. The page returned 21.00:1 and marked all four displayed WCAG levels as passing. A separate calculation with the WCAG relative-luminance formula also returned 21.00:1. This is one narrow functional check, not a review of all ten utilities.

The initial page load requested same-origin CSS, JavaScript, and the favicon. No cross-origin resource appeared in the browser's performance entries during that check. We did not upload a private file, inspect every code path, or prove that later actions never open a network request.

Keep egress visible.

A privacy line in the footer can go stale while the JavaScript changes. For a sensitive file, open the network panel before selection. Clear the log, process a disposable fixture, export the result, and inspect every request. Repeat after a deploy or dependency change.

Content Security Policy can narrow which scripts and resources a site loads. MDN recommends a strict policy based on nonces or hashes and advises testing with a report-only policy before enforcement. The SVG Spark responses we fetched did not include a Content-Security-Policy header. That absence does not show an upload. It removes one useful browser-enforced boundary.[3]

Use throwaway input first.

Start with a fixture that contains no customer data, credentials, internal filenames, or unpublished work. Confirm the transform. Inspect the network. Then decide whether the real input belongs in that page. A local utility earns trust per build and per route, not once for the whole domain.

Interactive makeover / privacy badge replaced

Run the customs bay.

This replaces a passive "100% local" badge with an input class, four inspection gates, a connected scan rail, and a copyable review card. It is better because the user can see which checks remain open. The component drafts a test plan. It does not read a file or monitor the network.

Classify inputRun fixtureInspect egressSave receipt

Input class

Choose the most sensitive material the tool may receive. Then select the checks to include in the review card.

Material class
Inspection gates
Review card / structure only

Local-route receipt

PUBLIC / DISPOSABLE INPUT FIRSTThe plan starts with published material or a fixture that carries no private data.
0 inspection gates selectedSelect the checks this card should request. No file, network trace, output, or policy evidence is attached.
Sources read / October 8, 2026

Source log

Open the evidence boundary
  1. SVG Spark, "Ten utilities. Zero uploads.", read October 8, 2026. We read the collection page, contrast checker, and regular-expression visualizer. The site is the source for its browser-local and no-tracking claims.
  2. MDN, "Using files from web applications", updated October 7 and read October 8, 2026. MDN documents user-selected files, drag and drop, FileReader, object URLs, explicit object-URL cleanup, and a separate upload example.
  3. MDN, "Content Security Policy implementation", read October 8, 2026. MDN describes strict CSP, nonce or hash controls, report-only rollout, and the limits of CSP as one part of an XSS defense.
  4. Hacker News discussion, "SVG Spark", item 50013931, read October 8, 2026. We resolved the exact discussion URL through the Hacker News API. The thread led to the tool. It does not verify the privacy claim.

Artifact check: the public contrast checker loaded and responded to native text input. White and black produced 21.00:1, matching a separate WCAG luminance calculation. The browser recorded only same-origin resources during that narrow check. We did not inspect source code, process a private file, test all routes, or prove the absence of later network activity. The customs bay is an original planning component. It reads no files and captures no traffic.