Underfoot is a static web app: no server, no accounts, no API keys. It runs in your browser and talks only to the public data services listed in the README. Coordinates you probe go to those services (and are kept in your browser's local storage for the Recent list); nothing is sent anywhere else.

If you find a security problem, for example a way for a crafted link, file or API response to run script in the page, please report it privately through GitHub's security advisories rather than a public issue.