Processing boundary
The converter runs in the browser. Raw XML is not intentionally sent to an XMLSlice application server. Parsing and CSV creation run in a dedicated Web Worker so large jobs do not need to block the main interface.
Secure XML handling
- DOCTYPE declarations and external entities are rejected.
- XML nesting and discovered-field counts have defensive limits.
- Long node text is capped during mapping to reduce memory abuse.
- Work can be cancelled through AbortSignal-aware streaming.
- Spreadsheet-formula prefixes are neutralized by default in CSV cells.
Output and temporary storage
Where available, output can stream to a user-selected file. Other browsers may use origin-private browser storage or memory before creating a download. These fallbacks are reported in the interface so users can understand the output path.
What users should do
- Use an up-to-date browser and trusted device.
- Verify the address is https://xmlslice.com before opening sensitive files.
- Review exported columns and row counts before downstream imports.
- Keep formula protection enabled unless the destination is known to be safe.
- Do not share confidential source files in support messages.
Responsible disclosure
Send suspected security issues to support@xmlslice.com with the subject “Security report.” Include reproducible steps, affected URLs, browser details, and impact. Please avoid privacy violations, service disruption, destructive testing, and public disclosure before there has been a reasonable opportunity to investigate.