Files in the playground
The playground accepts pasted text or files that you select. It accepts TXT, CSV, PNG, JPEG, WebP, and PDF files. It checks the file extension, MIME type, byte size, and image dimensions before a reader processes the file. The default input limit is 2 MB.
The playground rejects unsupported files and remote URLs. Text that looks like a URL remains text. Selected bytes stay in browser memory for the operation and are not saved to browser storage.
Parser limits
The core package validates input and options with typed schemas. It treats timetable content as data. It does not execute imported content, read local paths, or fetch network URLs.
The default limits are 2 MB of input, 25 million image pixels, 100 PDF pages, 30 seconds of processing, and 5 MB of provider output. Core JSON, CSV, and iCalendar exports also have a 5 MB UTF-8 limit. Apps can lower these limits.
Provider limits
Separate packages handle images, PDFs, OCR, and remote recovery. Each extraction provider receives an abort signal, resource limits, and a progress callback. The parser checks provider output before it uses that output.
A provider must stop when requested, keep output within its limit, return structured failures, and clean up temporary resources. A provider failure becomes a warning when the parser can preserve the deterministic result.
What agent mode accepts
The agent package validates JSON requests and responses. The default tool accepts text and CSV. A host must declare support and inject a parser before it can accept bounded base64 image or PDF input. Agent mode does not read paths or fetch URLs. A host that enables recovery must set allowRemoteRecovery: true.
The JSONL command reads one request per line and writes one response per line. It bounds request and response bytes, binary data, input lines, and processing time. Malformed or oversized lines return a structured error and do not stop later requests from being read.
Web protections
The public web app sends a content security policy that blocks framing, plugins, remote connections, and unapproved script, object, worker, font, and media sources. It also sendsReferrer-Policy, Permissions-Policy,X-Content-Type-Options, andX-Frame-Options headers.
The health route returns only its status, service name, and version. It does not expose server settings or timetable content.
Report a vulnerability
Use GitHub private vulnerability reporting for a suspected security problem. Do not open a public issue with credentials, private schedules, exploit details, or personal data.
Include the affected version or commit, a short impact description, and safe reproduction steps. Redact schedule content. Review the project's security policy for the full reporting process.
TimetableKit does not control retention or processing by an optional third-party provider. Review that provider's terms before you enable remote recovery.