TTech
Technical Security Disclosures

Security & Architecture Standards

Document Version: 2026.1

Client-Side Isolation Guarantee

TTech was engineered to eliminate third-party data transmission risks. Processing of files, code snippets, cryptographic keys, and personal financial figures occurs entirely in the browser runtime sandbox without persistence.

1. In-Browser Sandboxing & Zero File Storage

Unlike legacy online utility websites that upload documents to remote cloud storage buckets for server-side processing, TTech uses native browser APIs:

  • PDF Processing: Document compilation, splitting, and merging execute using WebAssembly (pdf-lib) directly inside your browser RAM.
  • Image Editing & Resizing: Renders directly onto hardware-accelerated HTML5 Canvas memory buffers without disk writes.
  • CSV & Data Tables: Handled through local stream tokenizers (Papa Parse) without server ingestion.
  • Text & Code Formatting: Evaluated inside localized JavaScript closures.

2. Cryptographic Randomness & CSPRNG Standards

Our security utilities (Password Generator, Hash Generator, UUID Generator) strictly adhere to industry cryptographic standards:

  • We strictly prohibit the use of non-cryptographic pseudo-random engines (such as Math.random()) for security-sensitive outputs.
  • Random byte generation is executed via the browser's native window.crypto.getRandomValues() API, which sources physical hardware entropy from the operating system kernel (compliant with FIPS 140-2).
  • Cryptographic digests (SHA-256, SHA-512) utilize the standardized Subresource Integrity Web Crypto implementation.

3. Server-Side Request Forgery (SSRF) Protection

For network lookup tools (such as DNS record inspection, HTTP status checks, and WHOIS lookups), our edge gateway enforces strict security filters:

  • Target domains and IP addresses are parsed to reject private RFC 1918 subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Loopback interfaces (127.0.0.0/8, ::1) and internal local domains (.local, .internal) are blocked.
  • DNS-over-HTTPS (DoH) queries are routed through authenticated public resolvers with strict rate limits.

4. Vulnerability Disclosure & Bug Reporting

We welcome responsible security research. If you discover a security vulnerability or implementation defect, please report it to our engineering team at:

Subject Line: Responsible Security Disclosure

Please include a reproducible proof-of-concept and allow our team adequate time to remediate the report prior to public disclosure.