# Initial threat model

## Assets and boundaries

- Provider manifests, custom launch definitions, artwork, and frontend descriptors are untrusted.
- Discovery and launch parsing run as the gaming user, never root.
- Provider credentials remain owned by their provider/configuration owner.
- Project state is per-user under XDG paths and must use atomic replacement.
- Future IPC is local, owner-only, size-limited, authenticated by OS credentials, and optional.

## Mandatory controls before provider work

Use argument arrays rather than interpolated shells; reject traversal, control
characters, oversized inputs, unsafe symlinks, and unexpected encodings; redact tokens
and personal paths from evidence; constrain reads to documented roots; and keep fixtures
free of proprietary library dumps and live credentials.