Files stay in your browser.
RatScan is a local static analyzer. There is no upload endpoint, no scan queue and no server-side copy of your archive.
File scans
When you drop a .jar, .zip, .class or source file, the browser reads it with the File API and JSZip. Extraction, rule matching and report generation happen in the page. The file bytes are not sent over the network.
URL scans
If you choose “Scan with URL”, the URL is sent to the Cloudflare Pages Function at /api/scan-url. The function fetches the remote file and returns the bytes to the page. It refuses loopback, private and cloud-metadata addresses, and it does not retain the file. The remote host may log the request under its own policy.
Reports
Reports are stored in IndexedDB in this browser. Hash lookups are stored in localStorage. Nothing is synced to an account. Clearing site data removes the stored reports and lookups.
No execution
Archives are read as data. Classes and JARs are never loaded, launched or executed.
Scope
This is a static analyzer. It flags patterns and can miss malicious behavior. Treat the verdict as one signal, not a guarantee.