6. SVG Upload & Security

SVG is an XML format and may technically contain scripts, so every uploaded SVG passes through the module's built-in sanitizer before it is stored:

• Scripts, event handlers and interactive elements are removed
• References to external URLs (images, CSS imports, fonts) are removed — a sanitized logo never loads anything from a foreign server
• Document type declarations, XML entities and compressed .svgz files are rejected
• The cleaned file is validated again before it replaces your upload

Bitmap uploads (PNG, JPG, GIF, WebP, ICO) are verified by their real content, not just the file extension, and images above 40 megapixels are rejected.

This all happens automatically — a normal logo exported from Illustrator, Figma, Inkscape or any design tool passes through unchanged in appearance.