Security Practices Guide
Vanduo is presentation-layer code, but a few habits keep a vd3 app safe. The engine is designed to be CSP-friendly and conservative about where it will fetch or render external content.
Content Security Policy
<!-- A strict CSP works with vd3 — no inline scripts are required -->
<meta http-equiv="Content-Security-Policy"
content="default-src 'self'; img-src 'self' data:; style-src 'self'">Remote data is allow-listed
// The Suggest/Autocomplete remote source only fetches same-origin
// (or explicitly allow-listed) URLs — cross-origin endpoints are blocked.
<input data-vd-suggest-url="/api/search"
data-vd-suggest-allowlist="https://api.example.com">Treat v-html as a sharp tool
// v-html renders raw HTML — only ever pass trusted, first-party content.
// In vd3-docs it is used exactly once (the static changelog body). For anything
// user-supplied, render text with {{ }} or sanitise first.Checklist
| Practice | Why |
|---|---|
| Content Security Policy | vd3 ships no inline scripts, so a strict CSP just works. |
| Trusted v-html only | Raw-HTML rendering is reserved for first-party static content. |
| Same-origin remote data | Suggest fetches are restricted to same-origin or an explicit allowlist. |
| Dependency hygiene | pnpm's strict lockfile + isolated node_modules limit supply-chain risk. |
| No secrets in the bundle | Anything imported into the client is public — keep keys server-side. |