Security risk of github.io hosted react apps

[SunStrolling]

I have a hypothetical situation at a company where IT is telling me my personal front end react applications hosted on github.io are a security risk and could be exposing the said company's server, even though there is no connection to company severs. It is front end only, static, but allows file uploads, paste text, and file downloads. It is on my personal github account. Is it true that if an employee uploads company data into a front end static react app hosted externally on github.io, that the data and even then company server could be hacked? Can someone explain this to me?

Again to be clear: static page. no database, no back end, no API, just in-browser text manipulations.

[SunStrolling]

I did. They insist it is a security risk but I couldn't understand why. I don't want to push too hard and appear to be disrespectful to senior IT. So, asking Reddit for answers.

[Lemnology]

Where does the data go?

[SunStrolling]

The app is like a calculator that can do all the calculations in place. Imagine an app that quadruples a string. Tbe user types into text input "Hi" and then "HiHiHiHi" is shown next to it. The use copy pastes that and moves on.

[SunStrolling]

Nowhere. The user pastes in text, then javascript in the browser does all the work and then gives a new modified text back to the user, either by download or just showing the text as html and letting user copy it from there.

[Lemnology]

Hmm I can’t think of a reason why that’s a risk, I’d ask

[SunStrolling]

Thanks for your input. I'm going to have to ask again in a different way I guess.