01
Do not begin with raw browser navigation
Opening an unknown SVG directly can give it an execution context that differs from a safely embedded image. The exact behavior depends on the browser and how the file is loaded. A safer first step is to use a text viewer, code editor with execution disabled, or an application that documents its SVG sanitization boundary.
Keep the original file untouched. Work from a copy in a folder that does not contain sensitive adjacent files. If the source is untrusted, do not enable macros, extensions, or helper applications simply because the file requests them.
02
Look for active and remote features
Search the source for script elements, event attributes such as onload, foreignObject content, external image URLs, stylesheet imports, and links that use unexpected protocols. Also inspect use elements and resource references because visible shapes can depend on definitions elsewhere in the document.
A safe sanitizer should use allowlists for elements, attributes, URL schemes, and reference targets. Simple string replacement is not enough for XML and CSS contexts. If a tool cannot explain how it handles active SVG features, use it only with files you already trust.
- Block scripts and event-handler attributes.
- Reject unsafe URL schemes and unexpected remote resources.
- Preserve safe gradients, masks, clips, and internal references when supported.
03
Check the visual and structural basics
After sanitization, inspect the viewBox, dimensions, namespaces, groups, transforms, and definitions. Confirm that the artwork fits the declared coordinate system and that no large invisible shapes extend the bounds. Unexpected full-canvas rectangles or nearly transparent objects may affect selection and export.
Review text and fonts. A file can look correct on the creator's device but change when a font is missing. Decide whether to embed an approved font, use a safe fallback, or convert final lettering to paths. Keep an editable version before converting text.
04
Export a clean artifact and test the destination
Save the sanitized result as a new file, then reopen that exact file in a separate viewer. If the SVG will be embedded on a website, use the safest embedding method that meets the product need and apply the site content security policy. Serving user-controlled SVG as an inline document has a different risk profile from rendering a trusted image asset.
Run both visual and security checks after optimization. Some optimization tools rewrite identifiers, merge paths, or remove definitions. The smallest file is not automatically the best file if accessibility text, editability, or safe references are lost.
Summary
What to carry forward
- Treat unfamiliar SVG as active content until it is sanitized.
- Check scripts, event handlers, remote URLs, and embedded HTML.
- Verify the final exported file visually and in its real publishing context.