Security

Client-side controls and recommendations

This page describes implemented client-side controls and recommended server-side measures for hosted deployments.

Client-side controls

• Core processing (format/validate/minify/xpath) runs in-browser in a Web Worker.
• Streaming parsing uses sax configured to avoid external entity resolution.
• XPath evaluation runs in the worker using fontoxpath.

Deployment recommendations

• Serve over HTTPS/TLS and configure secure headers.
• Enforce a strict Content Security Policy for hosted pages.
• Harden any server-side XML parsers against XXE and disable DTD/external entity fetching.
• Use rate limiting and monitoring for any APIs and avoid logging request bodies containing sensitive XML.