# Security Model

## Trust boundary

The plugin controls only a user-selected existing Godot executable and a selected Godot project. It does not grant downloaded project content permission to choose an executable, arbitrary command, environment, or output path.

## Process safety

- Godot is launched with an absolute executable path and a fixed argv shape.
- `shell: true`, arbitrary shell fragments, and caller-controlled argument prefixes are forbidden.
- Child stdout/stderr are bounded.
- Export and native runtime processes are single-owner and lifecycle-managed.
- Stop, plugin disposal, and Harness shutdown terminate the managed process tree.

## Filesystem safety

- Project roots must be absolute and contain `project.godot`.
- Preview output must resolve inside the project root.
- Static preview requests are canonicalized and constrained to the active successful output directory.
- Directory listings, reparse-point escapes, and `..` traversal are rejected.
- Failed exports cannot replace the last successful preview.

## Network safety

- Preview networking binds only to `127.0.0.1` by default.
- Host API requests require the plugin-specific `x-dsh-godot-preview: 1` header.
- Host and Origin validation limit browser requests to the local Harness origin.
- API responses disable caching.
- The plugin does not upload project files or enable telemetry.

## Browser bridge safety

Preview iframe URLs must be loopback URLs supplied by the Host snapshot. Client code rejects external schemes and non-loopback hosts. `postMessage` integrations, if enabled later, must validate origin, source identifier, message shape, and message size.

## Secrets

The plugin does not request, store, or log passwords, tokens, cookies, account data, payment data, or signing credentials.