> ## Documentation Index
> Fetch the complete documentation index at: https://invariant-cad.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Supported releases, vulnerability reporting, trust boundaries, and dependency policy.

## Report privately

Use [GitHub private vulnerability reporting](https://github.com/shlokjain42/invariantCAD/security/advisories/new)
for a suspected vulnerability. Do not disclose an unpatched issue in a public
issue, discussion, pull request, or social post.

Include the affected version and runtime, a minimal reproducer, impact,
reachable trust boundary, whether untrusted input is required, and any proposed
mitigation. The canonical response policy is
[`SECURITY.md`](https://github.com/shlokjain42/invariantCAD/blob/main/SECURITY.md).

## Supported line

The current `0.1.x` line receives security fixes. Pre-release development
commits and old `0.x` minor lines may require upgrading to the newest supported
minor.

## Threat boundaries

InvariantCAD processes potentially hostile JSON documents, parameters,
topology evidence and snapshots, native exchange or future artifact bytes,
WebAssembly modules, custom module factories, and output metadata.

Document parsing applies byte, structure, depth, query, reference, adjacency,
and evidence limits before schema validation. Kernel/native boundaries apply
capability checks, exact fingerprints, record ceilings, and ownership rollback
where the protocol defines them.

## WebAssembly is native-capability code

Only load JavaScript glue and WASM from trusted, matched sources. A custom
`moduleFactory` executes code with the privileges of the containing JavaScript
realm. In Node.js, that can include filesystem and process access available to
the application.

Run untrusted or high-cost workloads in a worker, process, or container with
host resource limits. An `AbortSignal` is cooperative and cannot preempt every
same-thread synchronous native call.

## Attested owned OCCT loading

For a reviewed owned-facade bundle, use
`invariantcad/kernels/occt/node` or
`invariantcad/kernels/occt/browser`. The loaders copy caller-owned manifest,
JavaScript, and WASM bytes; verify exact canonical `metadata/release.json`
against an independently trusted SHA-256 pin; and verify the runtime file sizes
and digests before supplied JavaScript executes. A digest fetched beside an
otherwise untrusted bundle is not an independent trust anchor.

The resulting `attestedRuntime` is an opaque authority accepted only by the
evaluated InvariantCAD internal module instance that created it. Its visible
attestation report can be cloned, but the executable authority cannot be
reproduced or transferred to another Worker. `createOcctKernel` supplies a
fresh verified WASM copy, checks the initialized facade marker, and binds the
exact pair identity only into the repository-private artifact fingerprint. It
still does not advertise `shapeArtifacts`.

In Node.js, the loader creates no temporary executable file. Node 22.15 and
newer use an isolated `node:module.registerHooks()` hook per load and
deregister it after import. Node 22.13 and 22.14 retain the compatible
process-wide `node:module.register()` worker-hook fallback, for which the
Permission Model must allow workers. The evaluated module cache remains for
the process lifetime on either path. In browsers, the loader imports a unique
Blob module URL and requires `blob:` in the applicable `script-src` policy. A
Worker or child process remains the hard reclamation boundary.

The report's separate declared-build identity hashes the exact release manifest,
but `buildExecutionObserved`, `buildExecutionAuthenticated`,
`publisherAuthenticated`, and `certifiesCompatibility` remain false. This
mechanism does not defend a compromised realm, browser, extension, service
worker, Node module-hook chain, same-process attacker, host, or engine, and it
does not attest the wider application, InvariantCAD wrapper/library, or machine
instructions. See
[OCCT runtime attestation](/evaluation/occt-runtime-attestation).

## Dependency policy

Production releases require a zero-advisory package audit. The default Manifold
geometry core is vendored as versioned, SHA-256-pinned upstream artifacts,
avoiding its unrelated image/glTF dependency graph. `occt-wasm` is pinned
exactly because its JavaScript and WASM form a matched runtime.

Dependency alerts are not dismissed merely to make a badge green. Any future
exception requires documented reachability, fail-closed CI, and a removal plan.

## Security is not geometry certification

Passing validation or conformance tests does not certify a model as safe for
manufacturing, medical, structural, aerospace, or other high-consequence use.
Applications must apply domain-specific verification and process controls.