-
Notifications
You must be signed in to change notification settings - Fork 0
Security Model
ArtifactFlow does one unusual thing: it executes arbitrary, attacker-controlled HTML and JavaScript (the AI-generated artifacts) so a human can preview them, without that code stealing a session, reaching your application or another tenant's data, or hijacking the parent app.
- A separate artifact origin. Artifacts are served from a different host than the application. The browser same-origin policy is the foundation: application cookies and session never exist where the artifact runs.
-
A sandboxed iframe with scripts only. The iframe uses
sandboxwithallow-scriptsand withoutallow-same-origin, so the document lands in an opaque origin. No same-origin storage, no cookies, no access back to the parent. -
A strict Content Security Policy delivered as an HTTP header.
default-src 'none',connect-src 'none',object-src 'none',form-action 'none',frame-src/child-src/worker-src/fenced-frame-src 'none', andframe-ancestorslimited to the app origin. Because it is a header, it travels with the document even in a top-level context.
Everything else, including an injected in-page JavaScript guard that blocks the WebRTC constructors and stops an artifact from spinning up a nested browsing context (a child iframe or frame realm) where the guard would not run, is defense in depth, never the boundary. Ordinary network APIs are blocked, but the sandbox is not claimed to be a perfect no-network seal: residual, browser-dependent egress vectors are enumerated in the threat model rather than waved away. The browser enforces the box; the separate origin makes escaping the box pointless.
Saved artifacts are reached through HMAC-signed URLs bound to the page, the version, and an access revision, with a short time to live and a fail-closed signing key that is distinct from the application key. Changing access (a grant, a revocation, a mode change) increments the revision and invalidates outstanding URLs.
An artifact can navigate its own throwaway tab, and it is inert by design (no ordinary network APIs, no persistence, no popups). These are product boundaries, not bugs. Under an opaque origin with no cookies and no ordinary network access, self-navigation has nothing to steal.
The complete, opinionated threat model, including what is theater and what is load-bearing, lives in THREAT-MODEL.md. To report a suspected escape, see SECURITY.md.