Skip to content
Webfold Docs
Esc
↑↓navigate↵open⌘Jpreview
On this page

Security

Trust boundaries, known open findings, operator controls and how to report a vulnerability.

Webfold documents its security boundaries, including the findings that are still open. Read this before pointing it at untrusted input or exposing any of its services.

Runtime boundaries

  • HTML conversion does not execute JavaScript. Headless and engine paths execute a supported script fragment and have a different attack surface.
  • Direct native fetching uses the transport dependency. Proxy fetching can invoke curl, WARC decompression can invoke gunzip, and PDF commands can invoke pdffold. These helpers are part of the trusted perimeter.
  • The Lean IPv4 predicate is a reference model. It does not establish DNS, redirect, IPv6, proxy or socket-level SSRF prevention. Treat any interface that takes a URL as able to reach the networks available to the process.
  • Parser output is untrusted Markdown. It is not HTML sanitisation, prompt-injection prevention, or a guarantee that hidden or script text cannot leak.
  • The 64 KiB substrate buffer is not a process-memory cap. DOM, strings, parser stacks, caches and external processes need independent limits.
  • CDP exposes a subset of browser operations and accepts some setup requests as no-ops. A successful protocol response is not evidence of isolation.

Open findings

The current navigation path retains page storage and runtime state across origin changes, and origin-block rules do not guard every native navigation call. WebAssembly execution has no instruction budget and its global handles are not bound to a caller origin. HTTP input, renderer output and several document expansion paths lack complete allocation bounds. The FlareSolverr-compatible binary defaults to an unauthenticated all-interface listener. These remain open.

Operator controls

  • Run untrusted acquisition with restricted network egress and filesystem access.
  • Apply request and job deadlines, process memory limits and output-size limits at the deployment boundary.
  • Keep CDP, MCP and proxy services on controlled interfaces.
  • Pin dependencies and helper binaries, and sanitise output for its eventual renderer.

These are deployment requirements, not properties proved by the extraction model.

Reporting a vulnerability

Do not open a public issue. Email security@webfold.ai with the affected commit, command, minimal input, observed result and any external helpers. Please do not publish exploit details before maintainers can triage them.

Reports we treat as security issues include unintended execution, file access, network access, isolation failures, hostile-input denial of service, and misleading success that crosses a trust boundary. Extraction mistakes are correctness issues unless their effect crosses such a boundary.