Security Model

Security Model

Trust boundaries

Surface	Rule
Registry content	Data, never code. Never executed by the CLI, the API, or the main site origin.
Home + catalog cards	Static WebP previews only. Zero registry execution — no Tailwind, no three.js, no WebGL.
Component detail playground	Real demo runs only inside <iframe sandbox="allow-scripts"> with no allow-same-origin (opaque origin: no access to site DOM, cookies, storage, or API). The iframe bundle is fixed at site-build time from the validated in-repo registry/ tree; no remote or user-supplied code loads. Parent ↔ iframe talk over validated postMessage (source + nonce + typed schema, plain JSON props). Heavy 3D/WebGL runs only after clicking "Run live preview"; one live playground per page, destroyed on navigation.
Supply chain (CLI)	SHA-256 hash recomputed before any write; dependency allowlist enforced; path containment; atomic writes with rollback.

A broken demo shows the static WebP with a notice — it never breaks the page.

Builder guards

Strict Zod schemas, dependency allowlist, import analysis, AST security scan (eval, new Function, string-arg timers, Worker, fetch/XHR, cookies, innerHTML family), CSS url()/@import/expression() rejection, full typecheck, canonical hashing, immutable versioned archives.

These are mistake-guards, not boundaries. Human review of every component PR is the primary control; the sandbox is defense in depth. Residual risks live in docs/SECURITY.md.

Reporting vulnerabilities

Please open a private security advisory on GitHub, not a public issue. Dependabot alerts are triaged promptly. Secrets live only in .env — never in code, logs, or commits — and .env.example tracks every required key.

Details: docs/SECURITY.md in the repo.