Local files in Min are not correctly treated as unique security origins, which allows them to improperly request cross-origin resources. The original report demonstrates a scenario in which a local file requests other local files through an XML document.

Note that the original issue summary is not entirely correct, as the issue in fact only occurs when a local file is opened inside Min, and does not occur on http(s) URLs.