The app has no backend, no accounts and no storage beyond localStorage (theme, contrast and a local history of conversions). Documents never leave the visitor's device, so the realistic risks are client-side:

• XSS through converted content — HTML input and rendered previews are sanitised with DOMPurify before they touch the DOM.
• Malicious library delivery — conversion libraries load from jsDelivr at pinned versions, restricted by a strict Content-Security-Policy (object-src 'none', form-action 'none', no unsafe-eval; pdf.js runs with isEvalSupported: false).
• Resource exhaustion — uploads are capped at 100 MB per file and parsing is asynchronous so the tab stays responsive.

The latest commit on main, and the currently deployed worker build, receive fixes. Older builds are not patched — redeploy instead.

Email clonera225@icloud.com or send a private message on Telegram. Please include:

• what an attacker can achieve;
• a minimal reproduction (input file or URL);
• affected browser and build version (visible as script.js?v=<build>).

Please do not open a public issue for an exploitable bug. Expect a first reply within a few days; fixes ship as a new worker build with a note in CHANGELOG.md.