Most vendor security pages list certificates. Ours starts with architecture, because the strongest control is the one you can verify yourself in thirty seconds.
The Sqwig component is client-only: static files served from your origin, executing on the end user's device. It operates no servers, holds no user data, and makes zero network calls of its own — spellcheck runs against a dictionary downloaded with the component, and license keys are Ed25519-signed tokens verified offline, in code. You can confirm all of this in your browser's network tab, on this very site: the hero editor on the homepage is the shipped component.
That removes whole vulnerability classes by construction: no credentials or sessions for Sqwig to mishandle, no Sqwig-side database to inject into or exfiltrate, no server-side request forgery, no third-party data path to your users' words. What remains is a deliberately narrow surface:
getHTML(), and the sanitization of pasted content on the way in.The full security model — including the trust boundary your application owns (parameterized queries, server-side re-sanitization, CSP) — is documented for your engineers in the developer docs.
Client-side filtering should never be anyone's only security boundary — including ours, which is why the docs tell your team to re-sanitize server-side. But we hold our boundary to an adversarial bar:
@noble/ed25519 and @noble/hashes, audited cryptography libraries used for offline license verification. Everything else is build/test tooling that never reaches your bundle.Email security@sqwig.com with the package version and a minimal proof of concept. We acknowledge within 3 business days, assess confirmed issues within 14 days, and follow coordinated disclosure — up to 90 days from report to publication so a fix ships first, with credit to the reporter unless you prefer otherwise. Good-faith research within this policy will never be met with legal action. A SECURITY.md with the same policy ships inside every npm package.
Security questionnaires assume a cloud service holding customer data. Sqwig isn't one, so two standard asks have non-standard — and stronger — answers:
A SOC 2 report audits a service organization's controls over the customer data it processes. Sqwig processes none: the component never transmits user content, and we operate no service in the data path. There is no processing environment to audit — the absence of the report reflects the absence of the risk, which is the outcome the questionnaire is probing for. (Editors that do carry SOC 2 carry it because their collaboration, conversion, and AI features send your users' text to their cloud.)
A Data Processing Agreement governs personal data processed on your behalf. Sqwig processes no personal data on your behalf, so there is nothing for a DPA to govern. Hand your procurement team this attestation:
Questions a questionnaire didn't anticipate? hello@sqwig.com — we answer these happily, in writing.