Project QuantityLABStart a project

Small public surface

Security

The production deployment is an allowlisted static build. Source files, tests, dependencies, Git metadata, environment files, and local deployment state are outside the public asset directory.

Browser-only architecture

There is no application server, database, authentication system, file upload, or protected API. Vue renders user labels as text, inputs are length- and range-bounded, and shared state has a strict size and shape limit.

Response protections

Production responses use a Content Security Policy, clickjacking protection, MIME-sniffing protection, a restrictive permissions policy, same-origin resource policy, and a privacy-preserving referrer policy.

Report a vulnerability

Report suspected vulnerabilities confidentially through the Project Quantity Lab GitHub Security Advisory form. Include the affected URL or component, reproduction steps, observed impact, and any suggested remediation. Do not open a public issue for an unpatched vulnerability. Do not test in a way that degrades availability, accesses data that is not yours, uses social engineering, or causes destructive changes.

Open the private vulnerability report form

Last reviewed: August 6, 2026. Product functionality and disclosures should be reviewed whenever third-party services or data flows change.