XOScript is designed with security in mind, providing essential cryptographic features, secure random byte generation, memory leak detection and runtime sandboxing. The runtime is intentionally small and simple, reducing the amount of code that needs to be trusted and audited. It currently runs on Linux and OpenBSD.

Complexity makes software harder to understand, maintain and secure. XOScript therefore keeps its syntax deliberately small, with a grammar consisting of no more than five rules. The result is a lightweight, 'scripty' programming experience without unnecessary language machinery.

XOScript focuses on the features commonly needed for server-side development, including request parsing, cookies, sessions, MariaDB, JSON, networking, basic regular expressions and encryption. Additional functionality can be exposed through FFI, allowing the language and standard runtime to remain small while still being fully featured.

XOScript allows you to record the program creation date at the top of each program. As the language evolves, newer runtimes can preserve the semantics required by older programs rather than forcing existing code to adopt incompatible changes. New features can therefore be introduced without breaking existing programs or turning every upgrade into a compatibility exercise.

XOScript provides a template engine designed to keep application logic separate from presentation. Templates use explicit markers to include and compose presentation fragments, while keeping programming logic out of the HTML itself. Context-aware escaping helps protect generated output against XSS.

XOScript is localized so that code can be written in your native language. Its grammar allows code to somewhat resemble natural sentences, making it easier to read, understand and reason about. Since code is often read more than it is written, expressing it in a familiar language can be especially helpful when working with business logic.