Keep the relationship surface small
The design avoids passwords, account sessions, server-side archive uploads, and public result URLs. The untrusted inputs are the user-selected archive and the strings inside it.
Input defenses
Path validation, encryption and ZIP64 rejection, compression limits, expanded-size caps, integrity checks, UTF-8 decoding, and JSON parsing occur before comparison.
Output and storage defenses
Username values are rendered as text, profile URLs are encoded, and optional analytics excludes exact rows. The baseline is origin-scoped and user-deletable.
Sponsored verification and disclosure
The adapter defaults off. Server-verified mode uses expiring random sessions and signed callbacks; it never treats a fake progress timer as completion.
Send a synthetic reproduction to [email protected], never a real export.