Skip to main content
Treat model output, RUI source, protocol records, bound data, URLs, and action payloads as untrusted. Rixx UI narrows generated output to validated data and a static registry of trusted React components.

​
Renderer controls

  • The language excludes raw HTML, MDX, JavaScript, CSS, generated SVG, dynamic imports, event handlers, and arbitrary expressions.
  • Component and action props validate against closed JSON Schemas.
  • Graph identity, references, cycles, depth, node counts, strings, tables, charts, and source length are bounded.
  • Partial source renders as inert provisional state; only a valid atomic commit enables interactions and custom components.
  • HTTPS URL syntax and credentials are checked before independent host link and image policies.
  • The core renderer emits no telemetry and never needs provider credentials.

​
Host responsibilities

The host must still authenticate the user, authorize every action against current server state, provide trusted confirmation UI, execute effects, deduplicate requests, audit results, validate external data, enforce Content Security Policy, and redact diagnostics or telemetry.
Client validation is not authorization. Action risk and approval describe required host handling; they never grant permission or prove consent.

​
Sensitive resources

Use resourceTiming: "committed" or "manual" when provisional image requests would leak data. Keep image allowlists narrower than navigation allowlists. Do not place credentials in generated URLs, source, catalog descriptions, fallback messages, or Devtools output. Read the complete threat model and report suspected vulnerabilities through GitHub private vulnerability reporting, not a public issue.