Privacy and Security by Design
Relevant source files
The following files were used as context for generating this wiki page:The Quant application is architected with a strong emphasis on user privacy and data security. The core design principle is that all vulnerability assessment data is processed and stored exclusively on the client-side. This ensures that sensitive information related to security assessments never leaves the user's browser, eliminating the need for user accounts, server-side processing, or data collection.
This approach provides users with a powerful, offline-capable tool that maintains complete privacy. The project's open-source nature further enhances security by allowing full code transparency and community audits. Key features like sharing and embedding are implemented in a way that preserves this client-centric model.
Sources: README.md:80-84, src/components/FAQAccordion.tsx:29-43
Client-Side Architecture
Quant operates entirely within the user's web browser. All CVSS scoring calculations, state management, and data manipulation are handled by pure JavaScript/TypeScript logic. There is no backend server involved in the core functionality of the calculator.
When a user interacts with the calculator by selecting metric options, the application's state is updated in the CVSSGenericCalculator component. This component then calls the appropriate version-specific scoring function (e.g., calculateCVSSv4Score) to compute the new score in real-time. The results are then rendered back to the user interface without any network requests.
Sources: README.md:81, src/components/CVSSGenericCalculator.tsx:241-262, src/lib/cvss/v4/scoring.ts:636-696
The diagram below illustrates the client-side data flow within the Quant application.
Data Handling and Storage
Quant is designed with a zero data collection policy. No assessment data or user activity is sent to any external servers.
No Account Required
The application can be used immediately without any registration or login process, reinforcing the principle of user anonymity.
Sources: README.md:82
Local Storage for Score History
For users who wish to save their assessments, Quant provides a "Score Manager" feature. This feature utilizes the browser's localStorage to persist score history. This data remains on the user's local machine and is not transmitted over the network. The addToHistory function is responsible for this local persistence.
Sources: src/components/FAQAccordion.tsx:32-43, src/components/CVSSGenericCalculator.tsx:180-194
Data Sharing and Exporting
Sharing and exporting functionalities are implemented to respect user privacy by keeping all operations on the client side.
Shareable Links
The "Share Link" feature generates a URL that contains the complete CVSS vector string as a query parameter. When this link is opened, the application parses the vector from the URL and pre-configures the calculator. This process does not involve a database or server; the state is transferred entirely through the URL itself.
The shareScore function in the calculator component constructs this URL and copies it to the user's clipboard.
The following diagram shows the client-side sequence for generating a shareable link.
Embeddable Widgets
Quant allows users to generate self-contained HTML snippets for embedding score cards on other websites. The generateEmbeddableCode function creates a complete HTML and JavaScript payload that renders the score card and handles its interactivity (like copying the vector) without communicating with any external server.
This ensures that embedded widgets are as private as the main application and do not track viewers or send data.
The sequence for generating an embeddable widget is as follows:
Summary of Privacy Features
The following table summarizes the key privacy and security features designed into the Quant application.
| Feature | Description | Implementation Evidence |
|---|---|---|
| Client-Side Processing | All scoring logic and calculations run exclusively in the user's browser. | src/lib/cvss/v2/scoring.ts, src/lib/cvss/v3/scoring.ts, src/lib/cvss/v4/scoring.ts |
| Zero Data Collection | No vulnerability data, scores, or user information is sent to a server. | src/components/FAQAccordion.tsx:29-31 |
| No Account Required | The application is fully functional without user registration or login. | README.md:82 |
| Local Storage | Score history is saved optionally to the browser's localStorage, not a remote database. | src/components/CVSSGenericCalculator.tsx:180-194 |
| Private Sharing | Shareable links encode the score vector directly in the URL, requiring no server state. | src/components/CVSSGenericCalculator.tsx:162-166 |
| Self-Contained Widgets | Embedded score cards are generated as self-contained HTML snippets that do not phone home. | src/lib/embed.ts |
| Open Source | The full source code is available for public audit and verification of security claims. | README.md:84 |
Conclusion
Quant's architecture is a clear example of "Privacy and Security by Design." By committing to a 100% client-side model, the application ensures that all user-generated data remains entirely within their control. This design choice eliminates common privacy risks associated with web applications, making Quant a trustworthy and secure tool for security professionals, developers, and organizations. The transparency of its open-source code further solidifies its commitment to these principles.
Sources: README.md:80-84, src/components/FAQAccordion.tsx:29-43