Security Statement

Client-side-only architecture

FireMan has no backend, no database, and no server-side processing of configuration data. The app is a static bundle (HTML/CSS/JS) served to your browser; every parsing step and every security check executes locally, inside the Teams tab, using only the JavaScript already downloaded to your machine.

No telemetry, no analytics, no cookies

Nothing about your usage, your device, or the configuration you upload is recorded or sent anywhere. The app does not set cookies and does not call any analytics or logging service.

Inside Microsoft Teams

The Teams SDK (@microsoft/teams-js) is used only for the app's initialization handshake and to read Teams' current light/dark/contrast theme so the tab's appearance matches the rest of Teams. No identity, authentication, or messaging APIs are used — the app requests no permissions.

The bundled Teams SDK may attempt one outbound request on load to refresh Microsoft's list of trusted Teams domains. Our Content-Security-Policy blocks this at the browser level before it can complete, and the SDK immediately falls back to its own identical bundled domain list — no data is sent, and functionality is unaffected. If you inspect the Network tab, you may see this single blocked (not completed) request; it never leaves the browser with any data.

Known limitation: administrator passwords in firewall configuration exports are stored as cryptographic hashes (e.g. SHA-256/PBKDF2), not plaintext. FireMan cannot and does not attempt to test password strength or crack these hashes — it only flags genuinely plaintext credentials found in a configuration, and says so explicitly in the report.

Verifying these claims

Open your browser's developer tools to the Network tab before dropping in a configuration file, and confirm no requests fire at any point during parsing or report generation.