diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 00000000..97090ef1
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,5 @@
+## 2024-05-22 - [XXE Protection in SVG Parser]
+
+**Vulnerability:** The `XMLDocument` initializer in `SVGParser.swift` used empty options `[]`, which potentially allows XML External Entity (XXE) attacks if the underlying parser defaults are permissive.
+**Learning:** Even when using higher-level abstractions like `XMLDocument`, one must explicitly disable dangerous features like external entity loading when processing untrusted input.
+**Prevention:** Always use `.nodeLoadExternalEntitiesNever` (or equivalent flags in other parsers) when parsing XML/SVG data from external sources.
diff --git a/Sources/SVGKit/SVGParser.swift b/Sources/SVGKit/SVGParser.swift
index 8f4e9d65..b4161dbd 100644
--- a/Sources/SVGKit/SVGParser.swift
+++ b/Sources/SVGKit/SVGParser.swift
@@ -327,7 +327,9 @@ public final class SVGParser: @unchecked Sendable { // swiftlint:disable:this ty
             data
         }
 
-        let document = try XMLDocument(data: svgData, options: [])
+        // Disable external entity loading to prevent XXE attacks
+        let options: XMLNode.Options = [.nodeLoadExternalEntitiesNever]
+        let document = try XMLDocument(data: svgData, options: options)
         guard let root = document.rootElement(), elementName(root) == "svg" else {
             throw SVGParserError.invalidSVGRoot
         }