Security

Threat model

The Service handles source code that is, by definition, more sensitive than anything we store. The design response is to never hold it:

• No upload path. There is no endpoint that accepts file contents. Parsing is performed by WebAssembly in the user's tab.
• No server-side rendering of user input. The generated documents are built in the browser and never transit our infrastructure.
• No third-party origin in the Content-Security-Policy. A compromised dependency cannot silently exfiltrate data, because there is nowhere to send it.
• Escaped rendering. File paths come from the user's own disk, and a repository can contain a file named <img onerror=…>.md. Every user-derived string is escaped before it reaches the DOM.

Controls

• Content-Security-Policy with default-src 'self', object-src 'none', base-uri 'self', form-action 'none', frame-ancestors 'none'. Set twice — as an HTTP header and as a meta tag — so it survives hosts that ignore _headers.
• X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Cross-Origin-Opener-Policy: same-origin, and a Permissions-Policy disabling camera, microphone, geolocation, browsing-topics and interest-cohort.
• TLS enforced by Cloudflare on every request.
• Rate limiting at the edge, keyed on a digest of the IP address and autonomous system number rather than the address itself.
• Dependency auditing in CI; two runtime dependencies (web-tree-sitter, fflate) plus zod pulled in by the vendored analyser.
• Build verification tests that fail if the deployed bundle references an asset that does not exist, or if the CSP meta tag is stripped.

Browser support

Feature detection, never user-agent sniffing. Sniffing is how you end up blocking a browser you have never heard of.

Reporting a vulnerability

Email abuse@contextbridge.app. We aim to acknowledge within five business days.

There is no bug bounty and we cannot offer payment. We will credit you in the changelog if you would like to be named, and we will not pursue legal action against good-faith research that does not damage the Service or its users.

Please do not test against other users' sessions. Because the Service is entirely client-side, almost everything can be tested locally against your own build.