VectorSentry 0.1.0

VectorSentry is a zero-runtime-dependency Node.js CLI and static browser application for conservative, local, text-only inspection of exactly one bounded UTF-8 SVG. It reports syntax-visible scripts, inline event handlers, external, relative, and data references, foreignObject elements, CSS URLs and imports, XML stylesheet instructions, entity declarations, duplicate IDs, unresolved internal fragment references, namespace anomalies, xml:base, and malformed lexical structure. It never renders, dereferences, executes, sanitizes, rewrites, uploads, or expands entities. VectorSentry is a lexical preflight, not a sanitizer, malware detector, complete XML/SVG conformance validator, exploitability verdict, or proof that an SVG is safe in every embedding context.

Tags svg xml security privacy javascript nodejs cli static-analysis
License MITL
State stable

Homepage Download

Recent Releases

0.1.022 Jul 2026 01:20 major feature: Initial release with a shared pure ESM scanner, Node.js CLI, static local-only browser interface, deterministic text and schema-versioned JSON reports, source locations, exact severity totals under bounded finding retention, strict UTF-8 and XML lexical handling, stable regular-file reads, explicit resource ceilings, 63 tests, and zero runtime dependencies.