foldrun 2.10.7 → 2.10.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/docs/security.md +11 -0
- package/package.json +1 -1
package/docs/security.md
CHANGED
|
@@ -142,6 +142,17 @@ name only — for the owner and admins to read or export. Support can view an
|
|
|
142
142
|
account only [read-only, for thirty minutes, with a reason the customer
|
|
143
143
|
reads](team-and-access#support-access).
|
|
144
144
|
|
|
145
|
+
## The dashboard in your browser
|
|
146
|
+
|
|
147
|
+
Every page is sent with an enforced Content-Security-Policy: scripts run
|
|
148
|
+
only with that response's own nonce (a fresh one per request) or when one of
|
|
149
|
+
those scripts loads them, and nothing is loaded from another site. Plugins,
|
|
150
|
+
framing by another site, a changed `<base>` and forms posting elsewhere are
|
|
151
|
+
refused. Pages are not cacheable, and also carry `X-Frame-Options: DENY`,
|
|
152
|
+
`nosniff`, COOP and CORP. HTML and SVG you store are never rendered on the
|
|
153
|
+
dashboard's origin. A self-hosted install can switch the policy to
|
|
154
|
+
report-only with `FOLDRUN_CSP` ([Environment](environment)).
|
|
155
|
+
|
|
145
156
|
## Your terminal
|
|
146
157
|
|
|
147
158
|
The CLI prints what a platform sends it — agents' replies, logs, files,
|