Security
Architecture at a glance
SVGKit is a static site: pre-rendered HTML and assets served from a CDN, plus a thin edge function that sets security headers and handles locale routing. There is no application server, no database, and no upload endpoint to attack.
How processing works
A tool decodes your input in the browser tab, sanitizes it with the site's shared SVG sanitizer, performs the transformation locally, and renders the result through the same sanitizer before preview. File content never crosses the network.
Active content handling
SVG can carry scripts, event handlers, external references, and foreignObject HTML. The sanitizer strips scripts and event handlers from previews, and the SVG Editor blocks active content on import. Optimizer workflows remove scripts by default.
Security headers
The edge function sets a Content-Security-Policy that allows only same-origin resources plus the two analytics origins, forbids framing (frame-ancestors 'none'), disables object embedding and base-URI hijacking, and restricts form targets. It also sets Referrer-Policy: strict-origin-when-cross-origin, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, and a Permissions-Policy that disables camera, microphone, and geolocation.
Dependencies and supply chain
Dependencies are installed from a committed lockfile. The image-tracing WASM engine (VTracer) is vendored as a static asset with a recorded SHA-256 hash, and its glue code is pinned in the repository. Third-party packages retain their own licenses (MIT/Apache for the tracing engine).
Data at rest on your device
The SVG Editor stores one recovery draft in local storage so a refresh does not lose work; the draft stays on your device and can be cleared in the editor. Interface preferences such as theme and language are also stored locally.
Browser permissions
SVGKit does not request camera, microphone, geolocation, or notification permissions. Uploads go through the standard file picker, and files you select are read locally.
Boundaries of the threat model
Local processing protects your files from our servers, but it cannot protect you from a compromised browser, a malicious extension with page access, or an untrusted SVG that you later embed somewhere privileged. Treat files from unknown sources carefully and validate output in its final environment.
Responsible disclosure
Report vulnerabilities to support@svgkit.dev with the affected URL, reproduction steps, expected impact, and the smallest necessary example. Do not access other users' data, degrade service, or publish an unpatched issue. We will not pursue legal action for good-faith research that follows these rules.
Response process
Reports are acknowledged as quickly as practical, triaged by impact, and fixed in a versioned release when confirmed. Reporters who want credit are named in the release notes unless they prefer to stay anonymous.
Vulnerability history
There are no publicly disclosed vulnerabilities in SVGKit to date. Security-relevant changes are listed in the project's releases alongside functional updates.
Contact
Security reports can be sent to support@svgkit.dev.