Security

• Markdown and StreamingMarkdown parse into React elements, without HTML and without dangerouslySetInnerHTML. HTML tags show as text.
• Links keep http:, https: and mailto:, plus relative links (/path, #id) in Markdown; StreamingMarkdown keeps them only with relativeLinks. javascript:, data:, vbscript: and protocol-relative URLs show as text, including mixed case and control characters. Citation uses the same check. Images (![alt](src)) render as links, so a message cannot load a remote image.
• Very long or deeply nested input can't stall the page: nesting is capped (blocks 32, inline 16), unclosed brackets and markers are scanned with a limit, and CI parses adversarial and random input with a time budget.
• CodeBlock renders tokens as text, and the highlighter stays linear on very long lines.
• FileUpload and PromptInput previews use object URLs and revoke them when the file is removed or the component unmounts. SVG files are shown in <img>, where scripts don't run.
• React 19 blocks javascript: URLs that you pass to href yourself (Link, Button asChild…).

• Prose styles whatever HTML you put in it and does not sanitize it. Sanitize HTML from users or a CMS first (for example with DOMPurify), or render Markdown with the Markdown component instead.
• Check URLs from users before passing them to href or src: allow https: (and the schemes you need), not data: for links.
• Limit the size of user and model content on the server; the client limits keep the page responsive, not your storage.
• Validate uploaded files on the server; FileUpload's accept and size checks are for the user, not for security.

Please report it privately, as described in SECURITY.md, not in a public issue.