How the S/U calculator keeps your sensitivity files private

In short

• The files you load (TSUNAMI SDF, Serpent _sens0.m, COVERX) are read by JavaScript running in your browser tab, into that tab's memory.
• The page sends no part of a file anywhere: not the sensitivities, the nuclide list, the file name, the title, k or the results. The results and the CSV downloads are made in the same tab.
• Nothing is saved. The calculator's scripts use no cookies, local storage or IndexedDB; reloading or closing the tab discards everything. (The visit counter's script reads one local-storage flag, skipgc, with which a site's owner stops counting their own visits; it holds nothing else.)
• The page does download, from this site, the covariance data of the nuclides in your files, so those requests name the nuclides (details below).
• A Content Security Policy in the page tells your browser to refuse any connection except to this site and its visit counter, whatever the page's code tries to do.

How the page is built

The site is static: GitLab Pages serves fixed files (HTML, JavaScript and JSON) from the public repository hardtohit10/hardtohit10.gitlab.io. There is no program on a server behind it, no database, no login and no upload address; a GitLab Pages site can only hand out files.

The calculator is three files, about 1,400 lines in all, readable exactly as your browser receives them: su-tool.html (the page), su-tool.js (its script) and su-core.js (the file readers and the arithmetic). Every change to them is in the repository's public history.

What happens to a file you load

1. You choose or drop a file. The browser hands the page a File object, and file.arrayBuffer() reads its bytes into memory. A file input only reads local files; sending them would need a form or a network request, and the page has neither (its policy forbids forms: form-action 'none').
2. A gzip-compressed file is decompressed by the browser's own DecompressionStream.
3. The text is decoded with TextDecoder and parsed by parseSDF or parseSerpent in su-core.js into arrays of numbers.
4. The sandwich rule, the breakdown and c_k are computed in the tab.
5. The CSV downloads are built in the page as data: links, which the browser saves directly to your disk.

The reading step, from su-tool.js:

const buf = await gunzipIfNeeded(await file.arrayBuffer());
addSDF(file.name.replace(/\.gz$/i, ""), file.size, new TextDecoder().decode(buf));

The only network calls in su-tool.js and su-core.js are fetch requests for the site's covariance files and, when you ask for them, the example files. Neither script uses XMLHttpRequest, sendBeacon, WebSockets, forms, cookies or browser storage.

What the page sends over the network

As with any web page, every server that answers a request also sees your IP address and your browser's identification string.

The covariance requests are the one place where something derived from your files leaves the browser. Whoever reads GitLab's server logs could tell that someone asked for, say, the U-235, U-238 and H-1 covariances of the AMPX-route library. They would not see a sensitivity, a file name, a title, k or a result. GitLab.com does not give the owner of a Pages site its access logs; the site's author sees only the GoatCounter counts. To avoid even the nuclide requests, run the calculator on your own computer.

Enforced by your browser

The calculator and this page carry a Content Security Policy, a list of rules in the page's <head> that your browser applies to everything the page does:

default-src 'self';
script-src 'self' 'unsafe-inline';
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
font-src https://fonts.gstatic.com;
img-src 'self' data: https://hardtohit10.goatcounter.com;
connect-src 'self' https://hardtohit10.goatcounter.com;
form-action 'none';
base-uri 'self';
object-src 'none'

So even a mistake in the page's code, or a later change to it, could not send your data to another server without also changing this policy, which anyone can read in the page source. Its limits: it allows requests to this site itself, which the covariance files need (GitLab Pages only hands out files, and the page's requests carry only file paths); a policy set in the page cannot control where you navigate yourself; and browser extensions you have installed can read any page you open, which no page can prevent.

Check it yourself

1. Open the calculator and your browser's developer tools (F12, or Ctrl+Shift+I; Cmd+Option+I on a Mac), and choose the Network tab. Tick “Preserve log”.
2. Load your files and press Calculate.
3. Every request is listed. You should see GET requests for files on hardtohit10.gitlab.io (the page and cov/…json files) and for the Google Fonts, and GoatCounter's count, a POST with an empty body whose few values are in its address. No request carries anything from your files: the Payload tab shows only the address's parameters.
4. If anything tried to reach another server, the Console tab would show that the connection “violates the following Content Security Policy directive” and “has been blocked”. (A test page with the same policy was opened in Microsoft Edge on 8 October 2026: a fetch, a sendBeacon and an image request to another site were all blocked, while the site's own files loaded.)
5. Read the code: search su-tool.js and su-core.js for fetch.

Running it on your own computer

For sensitive work you can run the calculator entirely from your own computer. Download the repository (about 30 MB to download, 150 MB on disk) and serve its public folder with any local web server, for example Python's:

git clone https://gitlab.com/hardtohit10/hardtohit10.gitlab.io.git
cd hardtohit10.gitlab.io/public
python3 -m http.server 8000

Then open http://localhost:8000/su-tool.html. The covariance files now come from your own disk, and the visit counter does not count local copies (GoatCounter's script skips localhost). Only the Google Fonts requests go out, and the page works without them, with your system's fonts. Opening su-tool.html directly as a file does not work, because browsers do not let a page read other local files with fetch.

Who can see what