This plugin runs inside your Obsidian vault, so its security posture is deliberately strict. This page lists every measure in place and where to see its live results; the project docs mirror this page.

Report privately via GitHub private vulnerability reporting — never in a public issue. Reports are acknowledged within a week and disclosed after a fix ships.

• Zero third-party runtime dependencies. The shipped bundle (main.js) contains only this repository's code plus @tsvsheet/tsvsheet; the compute engine is the tsvsheet Go implementation compiled to WebAssembly, running in-process with no I/O of its own.
• No network access. The plugin makes no requests; the engine, its Go runtime shim, and all assets are read from the plugin's own directory.
• No HTML from data. Grid values — including formula results and error strings — are rendered via textContent only, so vault content can never inject markup or script.
• Maintained, scanned dependencies only. Dev-time dependencies are held to the same bar as runtime ones: weekly Dependabot version updates, a strict npm audit (all severities, dev dependencies included) gating every push, and removal over replacement when a package goes unmaintained.

• Every commit is cryptographically signed; the organization enforces verified signatures on push.
• GitHub Actions workflows added by this repository grant least-privilege permissions (contents: read by default) and pin third-party actions by commit SHA.
• The .tsvt view persists only the engine's canonical source serialization — computed output is never written back to your vault files.