Defensive media handling
Source and poster URLs are sanitized before being applied to media elements. The codebase avoids using untrusted media values to construct arbitrary HTML.
Security policy
Read the project’s security policy for reporting guidance. Security-sensitive issues should be disclosed privately before public exploit details are posted.
Security regression tests
npm test
# Security coverage lives in:
tests/security/xss.test.js