Security
Local-first design
Files stay on your device. There is no processing server that receives SVG content.
Script handling
SVG files can contain script elements. Optimizer workflows remove scripts by default.
Untrusted SVG files
SVG can reference external resources, event handlers, styles, and scripts. Inspect unknown files and preview them in an isolated environment before using them in a privileged context.
Output validation
Review output after cleanup or conversion. Browser behavior, security policy, and target platforms differ, so automated processing cannot replace validation in the final environment.
Dependencies and hosting
SVGKit relies on browser runtimes, static hosting, and open-source software. Versioned builds and automated releases reduce deployment differences but cannot guarantee every third-party environment.
Responsible disclosure
Reports should include the affected URL, reproduction steps, expected impact, and the smallest necessary example. Do not access other users' data, disrupt service, or publish an unpatched issue.
Report a vulnerability
Security reports can be sent to [email protected].