Zeenat.js GitHub

Security

Content Security Policy

Use Zeenat.js under a strict CSP without unsafe-eval, injected style sheets, remote assets or data URLs.

CSP-friendly runtime

Zeenat.js uses no eval, generated style elements, inline script, remote assets or data URLs. Effects create DOM and SVG nodes, set element style properties and use the Web Animations API. Optional flag chunks are served with your application, so allow their origin in your script policy. A nonce prop is unnecessary because the library injects no style or script element.

Representative policy
default-src 'self';
script-src 'self';
style-src 'self';
img-src 'self';
connect-src 'self' ws:;
font-src 'self';
object-src 'none';
base-uri 'none'

Custom effect responsibility

Custom effects preserve this behavior only when they avoid injected stylesheets, inline scripts, eval, data URLs and remote assets. Prefer element style properties, SVG attributes and registered Web Animations.