Security

Report security problems privately to security@oscharts.com. Please don't open a public issue. We'll acknowledge within 3 business days.

How OSCharts keeps pages safe

• Every piece of text from a chart spec is escaped before it becomes HTML or SVG, and the spec travels in an escaped JSON data block.
• No inline styles, inline scripts or event-handler attributes, so a page can keep a strict Content-Security-Policy.
• Number formats are limited to standard number-format options; a source link is only made for https addresses.
• In CSV downloads, text that a spreadsheet would run as a formula is marked as text.
• No dependencies at run time, no network requests and no cookies.

The full list, with the tests behind it, is the repository's SECURITY.md.