Security

Security

Status: planned / pre-release. This wiki page mirrors docs/ and documents the intended API of next-herald. Nothing is published yet; names may change before v1.0. See ROADMAP.

Reporting and supported versions: SECURITY.md.

Threat model

Asset	Trust boundary	Threat	Mitigation
Rendered HTML	CMS/user data → <JsonLd>	XSS via </script>, <!--, U+2028	Safe serializer (ADR 0004); no raw-HTML API; XSS corpus in CI (#9)
Metadata	CMS data → Metadata	Tag injection	Next escapes attribute values; next-herald adds no raw tags
Sitemaps/XML	Data → XML	XML injection, invalid control chars	Escaping writer, control chars rejected, URLs RFC 3986 encoded
Canonical/hreflang	Request → URLs	Host-header poisoning of canonical	siteUrl from config only; request headers never read (ADR 0006)
Indexing	Env config	Preview/staging indexed; production noindex	indexing: 'auto'; noindex-leak rule
CI machine	herald check → network	SSRF / crawling third parties, huge responses	Same-origin only by default; --max-pages, per-response size cap (10 MB HTML, 64 KB image headers), timeouts; no redirects followed off-origin
Supply chain	npm	Malicious transitive deps	Zero dependencies (ADR 0002); npm provenance on publish
OG rendering	Data → Satori	Remote image fetch from user data	Docs: only pass trusted image URLs; templates never fetch URLs themselves