search

LavaMoat / LavaDome

Secure DOM trees isolation and encapsulation leveraging ShadowDOM
https://lavamoat.github.io/LavaDome/packages/core/demo/
MIT License
16 stars 3 forks source link

Audit defensive coding #2

Closed weizman closed 6 months ago

weizman commented 6 months ago

Make sure to audit entire code base to make sure APIs used aren't overridable by attackers. This also means we need to make sure loading of LavaDome is done synchronously and safely, I'm not yet sore JavaScript modules fit for the task, as they load async and therefore attackers might be able to front run them?

weizman commented 6 months ago

Consider managing natives (for defensive coding) in a separate package?

weizman commented 6 months ago

audit was done ed442b37f99e2ba0e78cd388ed7cc48366001d14