Security
What the library refuses to do, and what it checks.
No HTML injection surface
There is no dangerouslySetInnerHTML, innerHTML or eval anywhere in the library. Prose styles markup you already rendered and deliberately does not parse strings, so model or CMS output cannot become HTML.
Link hrefs are scheme-validated
React 18 renders a javascript: URL verbatim — only React 19 blocks it — and React 18 is inside the supported peer range. A footer built from a CMS collection would otherwise be a stored-XSS vector, so Footer, Navbar, Breadcrumb, Sidebar and Prose validate the scheme and drop anything unsafe. A target="_blank" link automatically gets rel="noopener noreferrer".
CSV export cannot execute
toCsv neutralises a cell beginning =, +, -, @, tab or carriage return before quoting, so a spreadsheet export cannot run code on your user's machine. Real numbers are exempt, so -5 stays a number while the string "-5" is guarded.
Content Security Policy
The library needs no script-src allowance. Responsive props are inline style attributes carrying custom properties, so a strict style-src needs a nonce or hash strategy. If you inline themeScript, give that script tag a nonce.