Docscope's fix round added 19KB of script that renders on load and passed
the scripts-on/off check, but the code says 'Simulate processing (in a real
implementation, this would parse the file)': a dropped file gets a canned
leak report. For a privacy tool that is worse than no tool.
- the checks flag the phrases generated code uses for canned output;
- the brief and fix rounds say the sample must be real input through the
same code path as a user's input, and point at browser built-ins
(DecompressionStream for zip, DOMParser for XML).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UpT7eWzeLhRwuYmsSQnbRb
Claude
c287a2acf6