Privacy and Security

Normal tool inputs and outputs are processed by client-side JavaScript and are not posted to the Lab Tool server as part of the transformation.

For signed-in history, Lab Tool may record the tool identifier, status, duration, payload size, and execution time. It does not send the input or generated output to the history endpoint.

A remote request tool is an intentional exception: it sends data to the endpoint you enter. Never send secrets to a destination you do not trust.

Authentication uses CSRF protection, secure sessions, prepared database statements, and administrator role checks.