Keep the task simple.
Keep the boundaries clear.
Nepocore processes tool inputs in your browser and has no application file-upload server. That reduces the need to share a file with a processing service. It does not make every file, export, device or website automatically safe.
How inputs are handled
Displayed user text is escaped, Markdown previews use a bundled sanitizer, and image/PDF operations apply file-size, page-count and output limits. PDF tools use a local PDF.js core and worker without a document action runner. HAR logs are inspected without replaying their requests. Native browser cryptography requires a supported secure context.
What you control
Camera and microphone start only after the relevant action and permission choice. Optional Save on this device records remain in that browser’s local storage. This is not an encrypted vault or cloud backup; another person using the same browser profile may be able to see saved records. Clear records and exported files separately when needed.
External resources and future changes
Optional OCR and background-removal engines may download resources from third-party hosts, and online system voices may contact their providers. See Privacy. Advertising and analytics are disabled. A future ad, account or server integration needs a new security and privacy review.
Review limits
The v7 update received a focused source and browser review, including tested Markdown and SVG input cases. This is not an independent penetration test, certification, malware scanner or guarantee of a vulnerability-free application. Hosting security headers depend on the actual provider. Keep your browser updated and verify important results.
Report a security issue
Email admin@nepocore.com with the affected tool URL, browser and a minimal reproduction using synthetic data. Do not send real credentials, production secrets, sensitive HAR logs or private documents. No bug-bounty or response-time commitment is implied.
The downloadable source package includes SECURITY.md with the review scope and implementation notes.
Last updated: