Security
The security boundaries and reporting expectations for jsonformatters.org.
Browser-first boundary
Public formatter engines execute locally with explicit resource limits. User JSON must never be written to application logs, analytics, advertising payloads, PostgreSQL, or Redis.
Platform controls
Production deployments should use HTTPS, CDN and WAF protection, immutable images, secure headers, a managed secret store, dependency scanning, redacted logs, monitoring, and tested rollback.
Admin isolation
The admin deployment belongs on a separate host with host-only cookies, managed identity, role checks, MFA, step-up authentication, and append-only audit events.
Responsible reports
Use the report control beside a tool for functional issues or missing features, but never include credentials, tokens, private JSON, or active exploit details. The endpoint validates origin and content, limits request size, applies distributed rate limits, and sends plain-text email only.