Security Model
What the product promises and what it does not
Architecture
Volume Shader is built as a static site. The home tool may create a local WebGL 2 context after open to show a still real preview frame; continuous scoring begins only when the user presses Start. The site does not require an application server, user account, file upload, or benchmark submission endpoint. PageView and Microsoft Clarity make separate traffic and interaction analytics requests.
The Content Security Policy disables frames and restricts external scripts and connections to the approved PageView, Clarity, and Bing endpoints. Benchmark reports are not submitted to a result collector or leaderboard; analytics behavior is described in the Privacy Policy.
Data lifecycle
- After open, the page may warm up a single still WebGL frame (or remain idle until the user engages the viewport). No timed score is recorded yet.
- Hover or drag can run a full-quality interactive preview without scoring; idle freezes continuous rendering again.
- The user presses Start to begin the timed scored render loop, which records FPS and elapsed time until Stop, page close, or browser termination.
- Stop ends the scored run, freezes continuous work when idle, and creates an in-memory report. Leaving the page or hiding the tab also pauses continuous rendering.
Risks reduced
- No password, sign-in token, private file, or payment information is required.
- No benchmark result is submitted to a hidden leaderboard by this site.
- Timed scoring begins only after an explicit Start action.
- A visible Stop control ends the scored run; idle and hidden-tab states pause continuous GPU work.
Risks not eliminated
- A compromised device, browser, browser extension, or operating system can observe page activity.
- Look-alike domains may copy the design or make false claims.
- Clipboard and screen contents can be observed by software with sufficient local access.
- A heavy GPU workload can cause temporary heat, fan noise, lag, or a browser freeze.
- Future dependency or hosting changes may introduce supply-chain risk and require review.
Vulnerability reporting
A private security reporting address will be published with the production domain. Reports should include reproducible steps and browser details, but must never include real credentials, private keys, or unrelated personal data.