Security

Charts hold content your users create and share. Saved layouts, drawings, and embeds travel between users, so the SDK treats every persisted source as untrusted input and renders it under fixed isolation rules. Configure the origins and policy described here before enabling embedded content.

Outcome

Embedded content renders inside a sandboxed frame that cannot reach the host page, restricted to the origins your product permits.

Before you start

• A deployed chart with drawing tools enabled
• Control of the Content Security Policy served with your application

Done when

A permitted link renders in a frame, a refused source shows the unsupported card, and no CSP violation appears in browser reporting.

Typical time

20 minutes

Embedded content isolation

The embed drawing tool accepts a provider link or a pasted embed snippet. The SDK reads the provider link out of that input and discards the rest. Pasted markup is never inserted into your page, and the SDK never adds a provider script tag to the host document.

Every embed renders inside one sandboxed iframe pointed at the provider's own embed endpoint:

Control	Value
Frame sandbox	allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox
Referrer policy	strict-origin-when-cross-origin
Permitted features	accelerometer, autoplay, clipboard-write, encrypted-media, gyroscope, picture-in-picture, web-share

The frame never loads your own application origin, so allow-same-origin keeps the embedded site on its own origin and grants it no access to the page that embeds it.

What an embed may load

An embed loads over https only. These sources are always refused:

• markup carrying inline script, event handlers, or srcdoc;
• any scheme other than https, including javascript:, data:, and plain http;
• any URL on your own application origin, which would let the frame reach the page that embeds it.

A refused source keeps its panel on the chart and shows an unsupported card, so the user can replace the link or delete the drawing.

Recognised providers

Links to these providers are rewritten onto the provider's own embed endpoint, so a share link, a short link, or a pasted snippet all resolve to the same frame:

Provider	Accepted input	Frame origin
YouTube	youtube.com/watch, youtu.be, youtube.com/shorts, youtube-nocookie.com/embed	https://www.youtube.com
Vimeo	vimeo.com/<id>, player.vimeo.com/video/<id>	https://player.vimeo.com
X	x.com/.../status/<id>, twitter.com/.../status/<id>, a pasted post snippet	https://platform.twitter.com

Any other https link is framed at the URL the user supplied. A host that merely resembles a provider is never rewritten onto that provider's endpoint.

Restricting embeds to an origin allowlist

Products that permit only reviewed content can restrict embeds to a fixed set of origins. Every other source is then refused and shows the unsupported card. Choose the origins your product allows, including any internal origin your users embed, and confirm the list with your TradeScript deployment contact so it ships with your build.

Content Security Policy for embeds

Embedded content needs frame-src for each origin your product permits:

frame-src https://www.youtube.com https://player.vimeo.com https://platform.twitter.com;

This directive is the enforcement boundary that survives regardless of what a user pastes, so list only the origins you accept. Omitting an origin blocks its embeds without affecting the rest of the chart. Embedded content adds no script-src requirement, because no provider script runs in your page.

For the remaining directives the SDK may need, see Production deployment.

Disabling embedded content

Remove the embed tool from the drawing toolbar when your product does not allow user-supplied external content. Existing embed drawings then render nothing, and no provider origin is contacted.

Reporting a defect

Report a suspected security defect to your TradeScript deployment contact, or to security@tradescript.dev for anything outside a licensed deployment. Include the package version, the build fingerprint from the bill of materials, the affected origin, and steps to reproduce.

Do not publish details before TradeScript has assessed the report and, where it elects to release one, delivered a fix to affected customers.

SECURITY.md ships at the root of the installed package and states the full policy, including what TradeScript does with a report and how advisories reach affected customers.

Related pages

Read Supply chain to verify the delivered files against the bill of materials, and Production authorization to keep the permanent credential on your backend and deliver only a time-limited lease to the browser.