Privacy and security

Source remains in memory; explicit SVG/PNG downloads are the only output. There is no telemetry, remote asset resolution, HTML injection, eval, directive execution or URL fetch. Complexity and raster output are capped.