SVG is in some way an advanced, editable version of PostScript, PDF's ancestor. Any SVG inside of an <img> tag is as safe as any image format. The JS code won'

SVG is in some way an advanced, editable version of PostScript, PDF's ancestor. Any SVG inside of an <img> tag is as safe as any image format. The JS code won't run, any external resources linked to from inside the SVG won't be loaded, the :visited CSS style is disabled[1]… For added security, you can even send an HTTP tag called Content-Security-Policy: default-src 'none'; img-src data:; style-src 'unsafe-inline' gives good results. That's what GitHub uses, by the way[2]. > It's not a format that's optimized for rendering like jpg You could argue the same of jpg in a comparison between jpg and bmp. You can animate SVGs even within an <img> tag with SMIL or CSS. Sure, there are a lot of features, and you could argue that it makes SVG complex; but the SVG specification[3] is not that much bigger than the PNG specification[4], if at all. It is irrelevant anyway when edited through a program, as PNGs usually are. [1]: https://developer.mozilla.org/en-US/docs/Web/SVG/SVG_as_an_Image https://developer.mozilla.org/en-US/docs/Web/SVG/SVG_as_an_I... [2]: https://github.com/atmos/camo/blob/master/server.coffee#L43 https://github.com/atmos/camo/blob/master/server.coffee#L43 [3]: http://www.w3.org/TR/SVG11/ http://www.w3.org/TR/SVG11/ [4]: http://www.w3.org/TR/PNG/ http://www.w3.org/TR/PNG/