Security overview · July 27, 2026
A self-hosted component with explicit boundaries.
RichTextEditor runs inside the customer application. Editor content, uploads, collaboration traffic and AI requests do not need to traverse RichScripts infrastructure. Security therefore combines shipped controls with host-application and infrastructure responsibilities.
| Surface | Shipped product control | Customer responsibility |
|---|---|---|
| Browser runtime | HTML sanitization, bounded paste processing, upload validation hooks and no required RichScripts telemetry endpoint. | Choose CSP, trusted origins, authentication and allowed content policy. |
| Uploads | Reference handlers validate size, extension and magic bytes; pluggable storage contracts isolate persistence. | Authorize each object, configure malware scanning, retention and private storage. |
| AI | BYOK resolver boundary; provider credentials stay server-side and requests have size/rate controls and audit hooks. | Select provider, region, retention policy, key vault and user authorization. |
| Collaboration | Room-scoped signed tokens, origin allowlist, payload/room limits, health telemetry, persistence and optional Redis fan-out. | Terminate TLS, protect secrets, operate Redis/LevelDB and bind document ownership to token minting. |
| Supply chain | Pinned packages, production dependency audits, protected-build guards and release-time distribution parity checks. | Monitor advisories, evaluate upgrades and inventory customer-added dependencies. |
Data flow
Browser → customer app for saves/uploads; browser → customer collaboration endpoint for Yjs; customer server → chosen AI provider when AI is enabled.
Vulnerability handling
Report suspected vulnerabilities privately through support with version, reproduction and impact. Do not include production secrets or customer content.
Review inputs
Provide deployment topology, enabled plugins, storage, identity boundary, CSP, collaboration mode and AI provider to scope a useful review.