Security & Privacy Compliance Guide
Zero Telemetry & Air-Gapped Philosophy
Modern developers and QA engineers frequently deal with sensitive information during day-to-day testing and debugging:
- Production JSON logs and payload dumps containing user PII (Personally Identifiable Information).
- Authentication tokens (JWTs, session IDs, bearer tokens) with user IDs and permissions.
- API secrets, private keys, HMAC tokens, and database connection strings.
- Internal microservice schemas and business logic.
Using standard online websites (e.g., online JSON formatters, JWT decoders, or regex testers) carries significant data privacy risks:
- Data in Flight: Pasting data into a browser can send raw payload bodies to third-party web servers and log aggregators.
- Server-Side Caching: Online tools often log query strings and request bodies in reverse proxies (Cloudflare, Nginx) or analytics databases.
- Compliance Violations: Transmitting PII, healthcare records, or payment data to unauthorized external endpoints violates GDPR, HIPAA, SOC 2, and ISO 27001 policies.
How DevUtils Guarantees Complete Data Safety
DevUtils was built ground-up with a strict, air-gapped security model:
1. 100% Offline Processing
Every single utility (JSON prettifier, JWT claims parser, regex evaluation, hash generation, etc.) is executed entirely locally on your machine. No computational step ever requires an internet connection.
2. Electron Sandbox & Context Isolation
Our Electron main process enforces the highest level of desktop application isolation:
webPreferences: {
preload: path.join(__dirname, '../preload/preload.js'),
contextIsolation: true,
nodeIntegration: false,
sandbox: true,
webSecurity: true
}
- No
eval() execution: External scripts cannot be loaded.
- Controlled IPC Bridge: The UI communicates strictly through explicit, predefined IPC channels defined in
preload.ts.
3. Zero Outbound Network Requests
- DevUtils does not include Google Analytics, Sentry, Mixpanel, or telemetry pings.
- There are no background update checks or external font/CDN downloads.
- All assets, fonts, icons, and styling are bundled locally within the desktop binary.
4. Enterprise Air-Gapped Environments
DevUtils can be deployed inside closed enterprise networks, VPN-restricted environments, or fully air-gapped workstations (defense, finance, banking) without requiring proxy exceptions or network firewall rules.
Verifying Compliance Yourself
Because DevUtils is completely open source under the MIT License, you can independently verify its offline behavior:
- Open the Developer Tools (
Ctrl+Shift+I or Cmd+Option+I) inside DevUtils.
- Switch to the Network tab.
- Perform any operation (decode a JWT, format a 50MB JSON file, generate HMAC hashes).
- Notice that zero network requests are sent.