Validate imports
ViText cleans HTML and checks supported tags, attributes and addresses before document import. Confirming formatting loss does not permit scripts or unsafe URLs. Client cleanup is not a substitute for validating stored/published content in your server application.
Restricted CSS
Only supported tag selectors and text-formatting properties are accepted. Classes/IDs, at-rules, pseudo-selectors, url(), positioning, variables and !important are rejected. Invalid CSS rejects the complete operation rather than applying a partial stylesheet.
Isolation
Document styles live in Shadow DOM. HTML/CSS exports are separate data; your publishing application must provide its own isolation. Trust sourceModuleURL/codecsModuleURL because they load executable resources. Do not accept arbitrary user URLs for those modules.
Application services
Your application owns file uploads, authentication, storage and policy. AI keys and authorization belong on its server. The Community website demo does not call an AI service. URL images and browser spellcheck can still use browser/network services. Images, privacy.