1. Where the CSP directive appears and what it says
Open the CubePlot HTML file in a text editor, or open it in a browser and right-click → "View Page Source" (or press Ctrl+U while it's open). Near the very top of the file, inside <head>, you'll find this single line:
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src data: blob:; font-src data:; connect-src 'self' blob: data:; worker-src blob:; media-src blob: data:; object-src 'none'; base-uri 'none'; form-action 'none'">This is a CSP (Content Security Policy) declaration — a standard security feature natively supported by web browsers. The browser itself reads this declaration and forcibly blocks any communication that would violate it. It isn't CubePlot's own code promising "we won't send anything" — it's a third-party piece of software (your browser) enforcing the block at runtime, which is the key point.
2. What each directive means
| Directive | Meaning |
|---|---|
default-src 'none' |
Baseline policy: everything is denied except what's explicitly allowed below |
script-src 'unsafe-inline' |
Only JavaScript written directly inside the file may run (loading an external script file is not allowed) |
style-src 'unsafe-inline' |
Only CSS written directly inside the file may be applied (loading an external stylesheet is not allowed) |
img-src data: blob: |
Images may only come from data embedded in the file or data generated in browser memory (fetching images from an external server is not allowed) |
font-src data: |
Fonts may only come from data embedded in the file (using an external font service is not allowed) |
connect-src 'self' blob: data: |
The most important directive. Restricts who JavaScript is allowed to communicate with to: "the origin CubePlot was opened from (a local file, or the SRW site it was served from)" and "data held in browser memory." No third-party server or domain is included at all — so even if the code contained an attempt to communicate externally, the browser would block it at that point |
worker-src blob: |
Background processing (Web Workers) may only be started from in-memory data. External scripts are not allowed |
media-src blob: data: |
Audio/video likewise may only come from data embedded in the file or in-memory data (no external streaming) |
object-src 'none' |
Third-party plugins and embedded objects are disabled entirely |
base-uri 'none' |
Prevents the page's base URL from being rewritten externally — a tamper-protection measure |
form-action 'none' |
No destination is allowed for form submissions (CubePlot has no form-submission feature to begin with, but this is defense in depth) |
Note
script-src and style-src include 'unsafe-inline' because CubePlot is a single self-contained HTML file with no external dependencies — its code and styles are written directly inside the file. The core of the data-protection design is connect-src, which prevents external transmission; the fact that it permits no third-party destination at all is what makes this design work.
3. How to verify it yourself (DevTools)
You don't need any technical background — three steps are enough:
- Before opening the CubePlot file, open your browser's developer tools (press
F12, or right-click the page and choose "Inspect"). In the panel that appears, select the "Network" tab - With that open, open the CubePlot file and go through its features — load a CSV, rotate/pan the 3D view, try color-by and slice, export a PNG, and so on
- Look at the list of requests in the Network tab. No matter what you do, no request to any external server is ever recorded (If you opened the file by double-clicking it directly, the list stays empty from the start)
Supplementary: an even simpler check
There's an even simpler way to verify this without using developer tools. Turn off your internet connection (e.g. disable Wi-Fi), then open the CubePlot file and use it as usual. If it communicated externally, functionality would break — but CubePlot works fully, with every feature intact, even with no network connection at all.
4. Verifying your downloaded files haven't been tampered with (hash values)
Beyond confirming that CubePlot sends nothing externally, you can also verify that the file on your machine is identical to what Soul Resonant Works actually distributed (i.e. it hasn't been tampered with or corrupted) using a SHA-256 hash. This is a second basis for trust, alongside the CSP-based communication check.
| Environment | Verification command |
|---|---|
| Windows (PowerShell) | Get-FileHash <filename> -Algorithm SHA256 |
| Mac (Terminal) | shasum -a 256 <filename> |
Compare the value shown against the official hash value. The official hash values are published in the appendix of the CubePlot manual, "Verifying Your Download." (They're computed as part of the same build as the application itself, so they're always current. Hardcoding the values on this page directly would require a manual edit every time they change, and a missed update could wrongly look like the genuine file had been tampered with — so the single source of truth for the actual values is kept in one place, the manual.)
What is covered
This covers the application file only (CubePlot.html / cubeplot_free.html). The manual PDF itself is not covered (embedding a hash value inside the file would change the file's contents — and therefore its own hash — making self-verification technically impossible).
If you have any questions, please contact biz@sr-works.net.
← Back to the CubePlot product page