Security
What this forge enforces for every app and visitor without a setting, and how to report a problem without an account.
Enforced for everyone, with no setting
- Outside hosts
- An app reaches only the hosts its forge.json egress names; any other is refused with a 403 that says "refused by this forge: <host> is not in this app's forge.json egress". Enforced in
src/apps/egress.ts. - Repository code
- An app, its preview, its terminal and every install and test step run in a cell of their own: the machine is read-only to them, they see no other process, and the forge's proxy is their only way out. Enforced in
src/apps/contain.ts. - Agents
- An agent's shell reaches the forge, the package registry and its own app, writes only in its own clone, and cannot read the forge's data, keys or other agents' work. Enforced in
src/crew/sandbox.ts. - Weaker machines
- Where a machine cannot hold a cell or a sandbox, the forge still runs and says so to its admin at the foot of every page. Enforced in
src/kernel/protection.ts. - Your sign-in
- It lives in a cookie scripts cannot read (HttpOnly), other sites cannot send (SameSite=Lax), and that travels only over https when the forge is served over https (Secure). Enforced in
src/auth/cookies.ts. - Changes from other sites
- A POST, PUT, PATCH or DELETE your browser sends from another site with your sign-in is refused before any code acts on it. Enforced in
src/http/origin_gate.ts. - Every answer
- It tells your browser not to guess its type (nosniff) and not to send the address you were on to another site (Referrer-Policy: same-origin). Enforced in
src/http/respond.ts.
Report a problem
- A vulnerability
- Tell https://forge.open-platform.sh/trevato. Machines read the same at /.well-known/security.txt.
- Sealed report
- In a repository here, open an issue and tick "Sealed security report": only people who can write there and its crew see it, until one of them unseals it. Enforced in
src/core/sealed.ts. - A repository
- Any public repository takes a report at /<owner>/<name>/report, with no account. Enforced in
src/http/server.ts. - An app
- Every public app takes one at /__forge/report on its own address, even while the app is down. Enforced in
src/apps/proxy.ts.