UK FrictionLab

Security — Planning & Permits Finder

The search endpoint validates and length-limits all inputs (keyword capped at 120 chars).
Outbound requests go only to data.gov.uk.
No server-side secrets, no third-party scripts, no tracking identifiers.
Responses are JSON; the UI builds DOM nodes, not innerHTML from raw query text.