PaperMosaic is designed as a browser-first document utility. The security boundary depends on the deployment, browser, CDN, third-party providers, and the specific tool a user selects. This page summarizes the current repository design; it is not a security certification or guarantee.
Most PDF operations load files into browser memory and produce results locally. The application does not require an account for those operations and has no PaperMosaic upload API in this repository. Users should still treat the browser, extensions, device, downloaded outputs, and hosting environment as part of their security boundary.
AI summarisation sends text to the OpenAI-compatible endpoint and authorization key configured by the user. Translation sends text to the selected translation service. Office conversion downloads public conversion-engine assets. Fonts and icons are loaded from external CDNs. Avoid optional features when a document must remain strictly offline or when the selected provider has not been approved for the document’s sensitivity.
AI endpoint settings are stored in the browser’s localStorage because the current application is client-only. Do not store a production credential in a shared browser profile. Clear site data after use on a shared device and rotate a key immediately if you believe it was exposed.
Do not disclose an unpatched vulnerability, access token, private document, or personal information in a public issue. Private reports may be sent to Voss Graves at primevideoistaken@gmail.com. This is a public contact identity and does not state that Voss Graves is a registered legal entity. If no private channel is available, open a public issue only with a non-sensitive description and request a private follow-up. The source repository is github.com/vossgraves/iLovePDFs.
Keep production dependencies and the hosting platform updated, use HTTPS, configure a restrictive Content Security Policy after testing CDN and worker requirements, review third-party endpoints before changing them, avoid collecting unnecessary telemetry, and test generated files before relying on them. A formal security review is recommended before processing regulated or highly confidential material.