mockstudio is a client-side web application with no backend: your images never leave the browser, and documents are stored locally (IndexedDB / files / share links). Only the latest release is supported with security fixes.

• All external input (imported .mock.json files, ?m= share links) is treated as untrusted and goes through schema validation (safeParse) + migration — malformed input falls back to a safe default document rather than executing or crashing.
• The app bundles no analytics and makes no network calls beyond fetching its own static assets.

Please use GitHub's private vulnerability reporting ("Report a vulnerability" under the Security tab) rather than a public issue. You can expect an acknowledgement within a week. Please include reproduction steps and, if relevant, a proof-of-concept .mock.json or share link.