Title: SVG analysis
Author: WordPress VIP Documentation
Published: August 2, 2021
Last modified: December 31, 2025

---

 1. [VIP Code Analysis Bot](https://docs.wpvip.com/vip-code-analysis-bot/)
 2. SVG analysis

#  SVG analysis

All SVG files introduced or altered in pull requests are scanned by an [SVG scanner](https://github.com/automattic/vip-go-svg-sanitizer)
maintained by VIP. The scanner will flag any non-whitelisted attributes or tags 
and report them in the automated code review by the [VIP Code Analysis Bot](https://docs.wpvip.com/vip-code-analysis-bot/).

The Bot enables analysis of SVG files by default to look for any attributes related
to security risks. SVG files are not regular images, but rather XML files that can
contain valid XML markup and even HTML markup, some of which can cause potential
security issues such as: 

 * Allowed `<iframe>` elements that can refer to external content.
 * Allowed `<script>` tags, a valid part of SVG markup, that can embed JavaScript.
 * An SVG can also reference an external SVG, which is embedded in the former SVG
   file.

VIP recommends that all SVG attributes and elements noted by the Bot are carefully
evaluated using Mozilla’s [MDN Web Docs](https://developer.mozilla.org/en-US/docs/Web/SVG)
on SVG elements and attributes, their purpose, and how they are used in SVG files.

## Skip SVG analysis

To skip SVG analysis of specific directories, add a file named `.vipgoci_svg_skip_folders`
to the root of [the application’s wpcomvip GitHub repository](https://docs.wpvip.com/wpcomvip-github-repository/)._
_Directories listed in this file, and the files that exist within them, will be 
ignored by SVG analysis scanning.

Last updated: December 31, 2025