Developer finds 3 security flaws in a fully offline, single-file web tool

A developer auditing a local, no-backend screenshot tool discovered three security vulnerabilities, all within the project file loader function. The first flaw allowed a malicious JSON file to inject an external image URL, silently triggering a network request that could expose the user's IP address and browser details — directly contradicting the tool's privacy promise. The second vulnerability involved pairing JSON.parse with Object.assign, which could enable prototype pollution by smuggling a __proto__ key through an otherwise routine object merge. The developer fixed both issues by enforcing a strict data-URL allowlist for image sources and replacing the generic merge with a hand-validated, key-by-key sanitization function. The findings highlight that even fully client-side tools can carry meaningful security risks when loading untrusted files.