Skip to content

Security: xcon-viewer/xcon-workflow

Security

docs/security.md

Security

The public XCON Workflow package is intentionally non-executing.

Not Included

  • No shell execution
  • No network calls
  • No filesystem reads or writes
  • No DOM mutation
  • No host app navigation
  • No arbitrary JavaScript execution
  • No environment variable access

Unsafe Actions

These action types are treated as validation errors in the public package:

  • script
  • custom
  • saveFile
  • openFile
  • filePicker
  • imagePicker
  • sendEmail
  • sendSms
  • sendPush

Scope Boundary

XCON Workflow is for inspection, linting, diagrams, and dry-run traces only. Any real shell, network, filesystem, host navigation, or JavaScript execution is intentionally outside this package.

There aren't any published security advisories