Skip to content

WEBFORGE_SECURITY.md

Latest commit

 

History

History
43 lines (32 loc) · 2 KB

WEBFORGE_SECURITY.md

File metadata and controls

43 lines (32 loc) · 2 KB
Raw

TechScript WebForge: Security Architecture & Auditing

Hardened Runtime Isolation, Sandboxing, and Web Vulnerability Defenses

1. Security Overview

WebForge is architected with a security-first posture to prevent common web and software supply-chain vulnerabilities by design.

2. Core Security Guarantees

A. Capability-Based Sandboxing

TechScript executes code within a strict capability model. An application cannot access sensitive system resources unless explicitly granted in techscript.toml:

[config]
capabilities = [
    "Network",      # Permits HTTP client and server sockets
    "FileSystem"    # Restricts file I/O to project directory only
]

If code attempts unauthorized operations (such as inspecting system passwords or spawning unsanctioned processes), the runtime halts with a capability violation error.

B. Path Traversal Defenses

The WebForge static file server and module resolver enforce canonical path resolution:

  • All file access requests are resolved relative to designated directories (public/, dist/).
  • Queries containing ../, null bytes, or URL-encoded equivalents (%2e%2e%2f) are immediately rejected with 403 Forbidden or 400 Bad Request.

C. SQL Injection Immunity

All database interactions generated by WebForge use parameterized statements (rusqlite::params![]):

  • Dynamic form inputs are never concatenated directly into raw SQL.
  • Table and column names are validated against compile-time AST schemas.

D. Cross-Site Scripting (XSS) Mitigation

  • All user-supplied text rendered via show text or show heading is automatically HTML-escaped.
  • Content-Security-Policy (CSP) headers are provided by the embedded server to restrict unsanctioned script execution.

E. Secure Package Supply Chain

  • TechScript packages do not run arbitrary pre-install or post-install shell scripts.
  • Every installed dependency is pinned to an exact SHA-256 checksum in techscript.lock.
  • Tampered or mismatched package archives fail verification immediately.