security.mdx - docs -

security.mdx (1657B)
      1 ---
      2 title: "Cryptography & Security Model"
      3 sidebarTitle: "Security & Threat Model"
      4 ---
      5 
      6 import Copyright from "/snippets/copyright.mdx";
      7 
      8 ## Zero-knowledge cloud password protection
      9 
     10 When a user applies a password to a Cloud Share snippet, the plaintext password is **never** transmitted to Firebase. Veyrix uses the native Web Crypto API to generate a SHA-256 hash locally instead:
     11 
     12 ```javascript
     13 // Internal Utility Method
     14 async function hashPassword(password) {
     15     const msgBuffer = new TextEncoder().encode(password);
     16     const hashBuffer = await crypto.subtle.digest('SHA-256', msgBuffer);
     17     const hashArray = Array.from(new Uint8Array(hashBuffer));
     18     return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
     19 }
     20 ```
     21 
     22 ## Threat model assumptions
     23 
     24 ### 1. Physical security
     25 
     26 Veyrix relies completely on the local OS and browser profile. If an attacker gains physical, unlocked access to the device, or compromises the browser profile (e.g. via a malicious extension), the IndexedDB store is considered compromised.
     27 
     28 ### 2. Cross-Site Scripting (XSS)
     29 
     30 Veyrix is an editor, not an evaluator. The Ace Editor parses content into Abstract Syntax Trees (ASTs) for highlighting — it does not execute code within the DOM. DOM string interpolations are secured via native `textContent` mappings.
     31 
     32 ### 3. Cloud anonymity
     33 
     34 Firebase interactions use `signInAnonymously()`. Data is tied to a temporary, anonymous session UID. Firebase Security Rules are assumed to enforce read/write access correctly based on the snippet UID, but shared URLs are considered semi-public unless protected with the SHA-256 password hash described above.
     35 
     36 <Copyright />