Security

SECURITY.md

Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in theSVG, please report it responsibly.

Do not open a public GitHub issue for security vulnerabilities.

Instead, please email: hello@thesvg.org

We will acknowledge receipt within 48 hours and provide a detailed response within 5 business days.

Scope

The following are in scope:

The @thesvg/icons and thesvg npm packages
The thesvg.org website
The build and publish pipeline
SVG content that contains malicious payloads (script tags, event handlers, etc.)

Out of Scope

Third-party integrations or extensions
Individual brand icon accuracy or design (contact the brand owner)

SVG Security

All SVG files in this package are automatically scanned for:

Embedded <script> tags
Inline event handlers (onload, onerror, etc.)
javascript: URIs
eval() or new Function() in generated code

See packages/icons/scripts/security-audit.mjs for details.

There aren’t any published security advisories