Security and data handling
The facts a vendor review asks for, in one page. Each one can be checked in the published package.
Where your data goes
Nowhere. Excel, PDF and CSV files are built in the user's browser from the rows the table already holds, and saved with the browser's own download. The rowpine package has no telemetry and makes no network calls, including for the license check.
Runtime dependencies
Three, as listed in the package's package.json. The two file writers are loaded with a dynamic import on the first Excel or PDF export, so a page that never exports never loads them.
| Package | Range | License | Used for |
|---|---|---|---|
| jszip | ^3.10.2 | MIT or GPL-3.0-or-later | Writing the .xlsx zip container |
| pdfmake | ^0.3.14 | MIT | Laying out PDF pages |
| @noble/ed25519 | ^3.2.0 | MIT | Verifying the license key signature |
The package has no preinstall, install or postinstall scripts. It ships as ES modules with TypeScript definitions and is marked free of side effects, so bundlers drop what you do not import.
The license check
A key is a short signed string: the licensed company, the plan, the number of seats and the last day of the update period, signed with Ed25519. The package verifies the signature in the browser against a public key built into it. There is no license server, no activation and no phone-home, so it works offline, behind firewalls and in air-gapped networks.
A missing or expired key never stops anything. Files carry one notice line and the console shows a message once.
Source you can read
The export menu, pivot table and pivot designer install through the shadcn CLI as MIT-licensed source files in your own repository, where your normal code review applies. Their source is public at github.com/rowpine/rowpine.
This website
rowpine.com is a static site on GitHub Pages and counts visits with cookieless analytics. See the privacy page.
Reporting a vulnerability
Write to info@jqwidgets.com with "Rowpine security" in the subject. Please include the version, the steps to reproduce, and what an attacker could do. Do not open a public issue for a security report.
Company
Rowpine is a brand of jQWidgets LTD, which publishes the package on npm and sells the licenses.