Security and privacy

Local editor files

The editor reads selected files inside the browser and creates object URLs. It does not inherently upload content. Any upload or persistence must be explicitly implemented by the host application.

Untrusted assets

Treat models and textures as untrusted binary content. Restrict file size, validate MIME/extensions where appropriate, and isolate authoring tools from sensitive sessions.

Remote URLs

Only load assets from trusted origins. Apply CORS and Content Security Policy rules, and avoid allowing arbitrary user-provided URLs in public pages without validation.

JSON validation

Run parseViewerPreset() or equivalent validation before accepting stored or remote configuration.

Denial-of-service risk

Very large geometry, textures, or pathological scene graphs can exhaust memory or block the main thread. Enforce publication limits and test assets before deployment.