-
Notifications
You must be signed in to change notification settings - Fork 0
Security Model
ArtifactFlow does one unusual thing: it executes arbitrary, attacker-controlled HTML and JavaScript (the AI-generated artifacts) so a human can preview them, without that code stealing a session, reaching the network, touching another tenant's data, or hijacking the parent app.
- A separate artifact origin. Artifacts are served from a different host than the application. The browser same-origin policy is the foundation: application cookies and session never exist where the artifact runs.
-
A sandboxed iframe with scripts only. The iframe uses
sandboxwithallow-scriptsand withoutallow-same-origin, so the document lands in an opaque origin. No same-origin storage, no cookies, no access back to the parent. -
A strict Content Security Policy delivered as an HTTP header.
default-src 'none',connect-src 'none'(no network),form-action 'none',frame-ancestorslimited to the app origin, and more. Because it is a header, it travels with the document even in a top-level context.
Everything else, including an injected in-page JavaScript guard, is convenience and defense in depth, never the boundary. The browser enforces the box; the separate origin makes escaping the box pointless.
Saved artifacts are reached through HMAC-signed URLs bound to the page, the version, and an access revision, with a short time to live and a fail-closed signing key that is distinct from the application key. Changing access (a grant, a revocation, a mode change) increments the revision and invalidates outstanding URLs.
An artifact can navigate its own throwaway tab, and it is inert by design (no network, no persistence, no popups). These are product boundaries, not bugs. Under an opaque origin with no network, self-navigation has nothing to steal.
The complete, opinionated threat model, including what is theater and what is load-bearing, lives in THREAT-MODEL.md. To report a suspected escape, see SECURITY.md.