Treat model output, RUI source, protocol records, bound data, URLs, and action
payloads as untrusted. Rixx UI narrows generated output to validated data and a
static registry of trusted React components.
Renderer controls
- The language excludes raw HTML, MDX, JavaScript, CSS, generated SVG, dynamic
imports, event handlers, and arbitrary expressions.
- Component and action props validate against closed JSON Schemas.
- Graph identity, references, cycles, depth, node counts, strings, tables,
charts, and source length are bounded.
- Partial source renders as inert provisional state; only a valid atomic commit
enables interactions and custom components.
- HTTPS URL syntax and credentials are checked before independent host link and
image policies.
- The core renderer emits no telemetry and never needs provider credentials.
Host responsibilities
The host must still authenticate the user, authorize every action against
current server state, provide trusted confirmation UI, execute effects,
deduplicate requests, audit results, validate external data, enforce Content
Security Policy, and redact diagnostics or telemetry.
Client validation is not authorization. Action risk and approval describe
required host handling; they never grant permission or prove consent.
Sensitive resources
Use resourceTiming: "committed" or "manual" when provisional image requests
would leak data. Keep image allowlists narrower than navigation allowlists. Do
not place credentials in generated URLs, source, catalog descriptions, fallback
messages, or Devtools output.
Read the complete threat model and report suspected
vulnerabilities through
GitHub private vulnerability reporting,
not a public issue. 
