Security model

A spec is data. Data can be stored, shared and generated by a model without someone reviewing each one, so the library is built to refuse anything that would make a spec behave like a program.

What a spec cannot do

• Contain a function, a script or a reference to one. Keys named code, script, eval, function, src, href, html, innerHTML and the on… event names are refused at any depth.
• Contain a string that starts javascript:, data: or vbscript:.
• Set colours. Only tokens, so no CSS value or URL can reach the page through a colour.
• Exceed the size, element or point limits. These are checked before the spec is walked, so a hostile document costs little to refuse.
• Reach the network. The library makes no requests and the site's Content-Security-Policy allows none from a picture.

How the library draws

The spec becomes a plan of numbers and token names. Only then does the p5 adapter run, and it calls p5 drawing functions with numbers and colours from the theme table. The description is set as text content, never as HTML.

The site

• Every page loads its scripts from the same origin, plus the pinned p5.js build on cdnjs. There are no inline scripts and no inline event handlers, so the Content-Security-Policy can stay strict.
• The playground runs the same library as your page and sends nothing anywhere. Spec text is written into the editor with text APIs, never as markup.
• Share links put the spec in the URL fragment. Browsers do not send fragments to servers, so the site does not receive what you share.
• No cookies, no analytics and no accounts.

Open items

• A code mode, where a sketch is run, is not built. If it is, it will run in a sandboxed frame with the sandboxCsp policy and no network. Until then, the library does not execute anything you give it.
• The p5.js build is pinned to 1.11.3 by URL. Updating it is a deliberate change, reviewed like any dependency.
• The package is not yet published, so there is no supply chain to audit beyond the repository.

Reporting a problem

Report security problems to the Dawnshift maintainers privately, not in a public issue. Include a spec that reproduces the problem, if you can.