Know where data flows
The Workflow Studio and Campaign Link Studio run in the browser. Their simulation and link generation do not require a service account or API integration. Local persistence is subject to browser settings and may be removed by the user, the browser or a device administrator.
Browser-local does not mean every network request is impossible: external fonts, hyperlinks and browser extensions can have independent behavior. Assess the whole page, not only the application code.
Treat imports as untrusted
Uploaded JSON should be parsed with strict limits on file size, array length, accepted type values and string length. Reject or normalize unknown schema fields; render user-controlled text with textContent rather than innerHTML.
Never interpret data from an import as executable scripts, selectors or network destinations without separate validation. Content Security Policy is defense in depth, not a substitute for safe DOM handling.
Local storage is not a vault
localStorage is convenient for preferences and small non-sensitive drafts. It is readable by scripts in the same origin and is not suitable for passwords, private API keys or confidential customer records.
In production multi-user products, server-side authentication, authorization, encryption choices, retention policies and incident response require additional implementation and review.
Give users portability
A JSON or CSV export is a deliberate data portability feature. Define formats, escaping rules and version fields clearly. Provide visible control to reset local drafts and explain what a download contains.
Our engineering stance is to describe these boundaries explicitly, without claiming external certifications or enterprise-level audits that have not occurred.
Review functional demos and engineering documentation.