Security model and coverage

The scanner treats components as hostile input. It observes bytes and metadata, never running the component.

Retrieval boundary

Only HTTPS on port 443 is accepted. Credentials in URLs, private/reserved/link-local addresses, IPv6 transition addresses and local hostnames are rejected. All DNS results must be public. Connections use a validated IP while TLS verifies the original hostname, closing the validation-to-connect rebinding gap. GET redirects are limited to two; POST redirects are forbidden. Registry artifacts stay on their expected hosts.

Hard limits

Artifact downloads are limited to 12 MiB. Extracted data is limited to 32 MiB, 1,500 archive entries, 1 MiB per file and a 150:1 expansion ratio above a 1 MiB allowance. JSON is limited to 1 MiB, depth 40 and 30,000 nodes. Tools are limited to 250 per manifest. The scanner subprocess has a 45-second wall deadline, a 35-second CPU limit and a 384 MiB address-space limit on Linux.

Archive boundary

Every member name is validated. Absolute paths, traversal, backslashes, drive prefixes, duplicate names, symlinks, hardlinks, sparse files, devices, encrypted entries and unsupported special members are rejected. Supported text is materialized in a private temporary directory and removed after analysis. Archives inside archives are not recursively unpacked. Binary files are not executed or rendered.

Evidence coverage

Supported text files, package manifests and explicit JSON tool manifests are examined. Generated runtime tool definitions, authenticated endpoints, stateful MCP sessions, arbitrary binary behavior, YAML structure and transitive dependency resolution are outside v0.1 coverage. Direct npm and PyPI versions are queried against OSV. Transitive dependency vulnerabilities are not resolved; lookup failures are disclosed in the report.

Capabilities are static indicators. A function name appearing in a README or dead code is not proof of effective permission. Each report discloses these limitations. Framework mappings use identifiers such as CWE-78, CWE-532 and CWE-1427; they are not claims of affiliation or compliance.

Tenant and billing boundary

Evidence is private by default and scoped to a workspace on the server. Public badges require an owner's explicit action and expose status only. Subscription events are verified with Stripe's official signature implementation, deduplicated by event ID and reconciled against authoritative subscription state. The browser cannot grant itself a plan.

Residual risk

Static analysis is incomplete. Resource isolation and input limits reduce the scanner's attack surface but do not prove absence of parser vulnerabilities. A monitoring error is not a clean result. Check timestamps and coverage, and independently review material changes.