Skip to content

docs: update SECURITY.md to clarify build-time trust boundary #34573

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alan-agius4 merged 2 commits into from
Oct 28, 2026
Merged

docs: update SECURITY.md to clarify build-time trust boundary #34573

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
df4421b
docs: update `SECURITY.md` to clarify build-time trust boundary
alan-agius4 Oct 28, 2026
fce83fc
fixup! docs: update `SECURITY.md` to clarify build-time trust boundary
alan-agius4 Oct 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,11 @@ The following defines some team policies around what does and does not constitut
- Prototype pollution is itself a DoS vulnerability.
- An attacker could pollute any symbol into the wrong type and cause an error, nothing we can do will prevent that.
- Therefore we don't care about any DoS vulnerability which relies on prototype pollution as a precondition.
- We trust the user's source code.
- We trust the user's source code and build-time inputs.
- "A malicious repository can execute untrusted code" is not a viable attack vector.
- A malicious repository could always rebind `node_modules/.bin/ng` to do something malicious, nothing we do can prevent that.
- We assume it is always unsafe to run an untrusted repository outside of a sandbox.
- Build-time configuration (`angular.json`, `routesFile`, environment variables) and values returned by developer-authored build-time functions (such as `getPrerenderParams()`) are considered trusted inputs. Passing unvalidated, untrusted data from an external source (e.g., a CMS or database) into build-time route generation or build configuration is an application-level input validation defect, not a vulnerability in Angular.
- DoS attacks which break only the attacker's client are not security issues.
- Exception: DoS attacks which waste server resources significantly beyond the cost of the attacker's request may be security issues.
- Memory leaks are considered general bugs, not DoS vulnerabilities.
Expand Down
Loading