Security reports

Do not put credentials, private designs, exploit details affecting real users or personal data in public issues. Send a private report to support.kivi@sigharmonic.com with the affected version, reproduction and impact. A response time or support SLA is not guaranteed.

Treat design files, archives and remote sources as untrusted input. The library applies parser and download bounds but is not a security boundary for arbitrary host scripts. Serve it with an appropriate content policy and update dependencies deliberately. The viewer cannot bypass CORS or authorization. Do not place private or signed design URLs into public embed or share links.