+ Security and Privacy Considerations on Core and JS-API

document/core/intro/introduction.rst

@@ -75,6 +75,21 @@ Instead, this specification is complemented by additional documents defining int
 These will each define a WebAssembly *application programming interface (API)* suitable for a given environment.
 
 
+.. index:: ! security, host, embedder,  module, function, import
+.. _security:
+
+Security Considerations
+-----------------------
+
+WebAssembly provides no ambient access to the computing environment in which code is executed.
+Any interaction with the environment, such as I/O, access to resources, or operating system calls, can only be performed by invoking :ref:`functions <function>` provided by the :ref:`embedder <embedder>` and imported into a WebAssembly :ref:`module <module>`.
+An embedder can establish security policies suitable for a respective environment by controlling or limiting which functional capabilities it makes available for import.
+Such considerations are an embedder’s responsibility and the subject of :ref:`API definitions <scope>` for a specific environment.
+
+Because WebAssembly is designed to be translated into machine code running directly on the host's hardware, it is potentially vulnerable to side channel attacks on the hardware level.
+In environments where this is a concern, an embedder may have to put suitable mitigations into place to isolate WebAssembly computations.
+
+
 .. index:: IEEE 754, floating point, Unicode, name, text format, UTF-8, character
 .. _dependencies:
 

document/js-api/index.bs

@@ -1084,3 +1084,11 @@ In practice, an implementation may run out of resources for valid modules below
 <li>The maximum number of locals declared in a function, including implicitly declared as parameters, is 50000.</li>
 
 </ul>
+
+<h2 id="security-considerations">Security and Privacy Considerations</h2>
+
+<p><em>This section is non-normative.</em></p>
+
+This document defines a host environment for WebAssembly.
+It enables a WebAssembly instance to :ref:`import <syntax-import>` and :ref:`export <syntax-export>` all Javascript functions and APIs.
+This WebAssembly instance is thusly bound to the same constraints as any other Javascript program.