Skip to content

security.md

Latest commit

 

History

History
38 lines (26 loc) · 2.03 KB

security.md

File metadata and controls

38 lines (26 loc) · 2.03 KB
Raw

Security model

This SDK moves provider credentials out of application JavaScript; it does not remove the integrator's security responsibilities.

Protected assets

  • Provider access and refresh tokens
  • Application session cookies
  • Loopback capability grants and nonces
  • Native-vault records
  • Provider prompts, responses, model catalogs, and usage metadata

Primary controls

  • Exact origin validation and CSRF protection for mutations
  • Authorization Code + PKCE and state validation where supported
  • HttpOnly, Secure, SameSite application sessions
  • Versioned encrypted credential records and native secret stores
  • Serialized refresh, callback, and logout mutations
  • One-time terminal pairing, origin-bound capabilities, and nonce replay prevention
  • Fixed upstream hosts and paths; no arbitrary authenticated proxy
  • Model allowlists, size/output/rate/concurrency limits, deadlines, and cancellation
  • Sanitized errors and response-header allowlists
  • Fail-closed CLI sandbox and authentication checks

Integrator threat model

Treat XSS in your origin as capable of using any in-memory bridge grant. The default clients avoid persistence so reloads require pairing again. If you persist capabilities, document and accept the increased exposure.

Treat localhost as a network boundary. Do not rely on loopback alone: validate Origin, reject forwarded requests, bind capabilities to one origin, and use one-time nonces.

Treat upstream success headers as untrusted until the required response is complete. Non-streaming responses are buffered before success is committed; streaming timeouts emit normalized error events.

Treat disconnect as a security action. Only update UI state after revocation/logout succeeds; show a retryable error otherwise.

Reporting vulnerabilities

Before public release, add a private security contact to SECURITY.md. Ask reporters not to open public issues for token disclosure, auth bypass, origin bypass, arbitrary proxying, keychain leakage, or sandbox escape. Define supported versions and a response-time target.