Active content is a generic name for powerful features in Trilium, these range from customizing the UI to advanced scripting that can alter your notes or even your PC.

## Safe import

Active content problem of safety, especially when this active content comes from a third-party such as if it is downloaded from a website and then imported into Trilium.

When importing .zip archives into Trilium, safe mode is active by default which will try to prevent untrusted code from executing. For example, a custom widget needs the `#widget` label in order to function; safe import works by renaming that label to `#disabled:widget`.

## Safe mode

Sometimes active content can cause issues with the UI or the server, preventing it from functioning properly. Safe mode allows starting Trilium in such a way that active content is not loaded by default at start-up, allowing the user to fix the problematic scripts or widgets.

## Types of active content

These are the types of active content in Trilium, along with a few examples of what untrusted content of that type could cause:

Name | Disabled on a safe import | Description | Potential risks of untrusted code
--- | --- | --- | ---
Front-end scripts | Yes | Allow running arbitrary code on the client (UI) of Trilium, which can alter the user interface. | A malicious script can execute server-side code, access un-encrypted notes or change their contents.
Custom Widgets | Yes | Can add new UI features to Trilium, for example by adding a new section in the Right Sidebar. | The UI can be altered in such a way that it can be used to extract sensitive information or it can simply cause the application to crash.
Backend scripts | Yes | Can run custom code on the server of Trilium (Node.js environment), with full access to the notes and the database. | Has access to all the unencrypted notes, but with full access to the database it can completely destroy the data. It also has access to execute other applications or alter the files and folders on the server).
Web View | Yes | Displays a website inside a note. | Can point to a phishing website which can collect the data (for example on a log in page).
Render Note | Yes | Renders custom content inside a note, such as a dashboard or a new editor that is not officially supported by Trilium. | Can affect the UI similar to front-end scripts or custom widgets since the scripts are not completely encapsulated, or they can act similar to a web view where they can collect data entered by the user.
Custom app-wide CSS | No | Can alter the layout and style of the UI using CSS, applied regardless of theme. | Generally less problematic than the rest of active content, but a badly written CSS can affect the layout of the application, requiring the use of Safe mode to be able to use the application.
Custom themes | No | Can change the style of the entire UI. | Similar to custom app-wide CSS.
Icon Packs | No | Introduces new icons that can be used for notes. | Generally are more contained and less prone to cause issues, but they can cause performance issues (for example if the icon pack has millions of icons in it).

## Active content badge

Starting with v0.102.0, on the New Layout a badge will be displayed near the note title, indicating that an active content is detected. Clicking the badge will reveal a menu with various options related to that content type, for example to open the documentation or to configure the execution of scripts.

For some active content types, such as backend scripts with custom triggering conditions a toggle button will appear. This makes it possible to easily disable scripts or widgets, but also to re-enable them if an import was made with safe mode active.