Toolity is a static website: tools run in your browser and we hold no user accounts or uploaded files. That keeps the attack surface small, but we still take every report seriously.
- toolity.in and all its pages and scripts.
- Cross-site scripting (XSS), injection through tool inputs, URL parameters or shared links.
- Anything that would cause a tool to send user files or text off the device without the user knowing.
- Embeddable widgets served from toolity.in.
- Third-party services we link to or use (GitHub Pages, Google, Iconify, public relays) — please report to them directly.
- Denial-of-service, spam, social engineering or physical attacks.
- Reports from automated scanners without a demonstrated impact, or missing best-practice headers that GitHub Pages does not let us set.
Email hello@toolity.in with the affected page, steps to reproduce and the impact. Please give us a reasonable time to fix the issue before sharing it publicly, and don't access or change other people's data while testing.
- We'll acknowledge your report and keep you updated while we fix it.
- We won't take legal action against good-faith research that follows this policy.
- With your permission, we'll thank you by name on this page once the issue is fixed.
Machine-readable contact: /.well-known/security.txt