18 lines
820 B
Markdown
18 lines
820 B
Markdown
# Initial threat model
|
|
|
|
## Assets and boundaries
|
|
|
|
- Provider manifests, custom launch definitions, artwork, and frontend descriptors are untrusted.
|
|
- Discovery and launch parsing run as the gaming user, never root.
|
|
- Provider credentials remain owned by their provider/configuration owner.
|
|
- Project state is per-user under XDG paths and must use atomic replacement.
|
|
- Future IPC is local, owner-only, size-limited, authenticated by OS credentials, and optional.
|
|
|
|
## Mandatory controls before provider work
|
|
|
|
Use argument arrays rather than interpolated shells; reject traversal, control
|
|
characters, oversized inputs, unsafe symlinks, and unexpected encodings; redact tokens
|
|
and personal paths from evidence; constrain reads to documented roots; and keep fixtures
|
|
free of proprietary library dumps and live credentials.
|
|
|