LexDev

SVG Spawn

AI-powered SVG animation tool — describe an animation in text and get SMIL/CSS output, backed by Gemini

Pre-LaunchLexDev

Key metrics

Metrics being defined

Competitive Intel

0 entries

No competitive intel entries for this product yet.

Research Hub

0 types

No research documents for this product yet.

Roadmap

9 items

Planned9

**`animated-preview.tsx:53`** — XSS via `dangerouslySetInnerHTML` with unsanitized SVG from mock fallback path. Fix: always re-sanitize SVG before rendering, or use sandboxed iframe.

**`linear-mode.tsx:109`** — Sends `{ prompt, svgString }` payload but endpoint expects `{ prompt, parentNodeId }`. Fix: create project first, then use returned ID.

**`linear-mode.tsx:42`** — Polls non-existent API endpoint (`/api/projects/${id}/jobs/${jobId}` vs actual `/api/jobs/${jobId}`). Always falls through to mock. Fix: change URL to `/api/jobs/${jobId}`.

**`nodes/route.ts:63`** — Race condition in credit check vs consumption. Credits checked at request time, decremented later in job worker. Fix: decrement atomically at request time and refund on failure.

**`poller.ts:33`** — Catch block in polling loop is empty; silently swallows all errors. Fix: add error counting and callback after N consecutive failures.

**`sanitize.ts`** — `<style>` element CSS not sanitized for `@import` or `url()` external references. Fix: strip external references from style text content.

**`upload-store.ts:29`** — `URL.createObjectURL` never revoked; memory leak on repeated uploads. Fix: call `URL.revokeObjectURL` on previous URL in `setFile` and `reset()`.

**`upload/route.ts`** — No server-side file size limit. Frontend enforces 5MB but API does not. Fix: reject `rawSvg.length > 5MB`.

**All API routes** — No authorization check: any authenticated user can access any project/node/job by guessing UUID. Fix: verify `project.workspaceId` belongs to requesting user.