A security-hardened VS Code extension providing high-fidelity previews for Draw.io, AUTOSAR ARXML, and PlantUML diagrams Built with security in mind.
🛡️ Security Architecture
This extension follows strict security principles to protect the development environment:
Strict Content Security Policy (CSP): Employs default-src 'none' with cryptographic nonces for script execution. External frames are strictly allowlisted only to https://embed.diagrams.net.
Iframe Sandboxing: The diagram engine runs in a restricted sandbox with allow-scripts, allow-forms, and allow-same-origin to prevent cross-frame scripting.
Privacy-First: No telemetry, tracking, or external data exfiltration.
