{"editorial_visual":"https://favicon.now/static/images/editorial/guides/favicon-security-and-tracking.webp","implementation_artifact":null,"published":"2026-07-31","section_headings":["Treat uploaded artwork as untrusted","Prevent server-side request forgery","Understand favicon tracking risk","Publish security boundaries"],"sources":[{"label":"OWASP SSRF prevention","url":"https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html"},{"label":"W3C SVG security","url":"https://www.w3.org/TR/SVG2/security.html"},{"label":"USENIX favicon tracking research","url":"https://www.usenix.org/conference/usenixsecurity21/presentation/solomos"}],"title":"Favicon Security: SVG Uploads, SSRF and Tracking","updated":"2026-07-31","url":"https://favicon.now/guides/favicon-security-and-tracking"}