Guest escape
Constrain host imports, native process access and operating-system privilege.
SECURITY / LIMITATIONS
A security model is defined by what it can deny.
OSR must distinguish tested local capability restrictions from missing process isolation, privileged service protection and operational assurance.
Priority threats and controls
Excessive permissions
Authenticate, restrict and revoke grants; revalidate at the exact resource operation.
Path and network bypass
Protect handles against traversal, symlink races, redirects, DNS rebinding and private-IP egress.
Resource exhaustion
Enforce memory, CPU, wall-clock and concurrency limits outside the guest.
Approval replay
Bind approval evidence to unique authenticated requests, resources, actions and policy versions.
Evidence tampering
Use key protection, signed receipts, retention controls and external checkable checkpoints.
Explicit known gaps
OSR 0.2 is not a production-secure arbitrary-code sandbox. Authenticated distributed grant administration, reliable host-side interruption, hardened filesystem handle operations, HTTP/database brokers, protected long-term evidence storage and independent assessment remain open engineering gates. Node.js Workers and ordinary hash chains are not sufficient guarantees.
Existing stacks still need security updates
OSR cannot repair vulnerabilities occurring before a request reaches its protected interface, and WordPress/PHP or Node.js applications must continue native updates, credential management and security maintenance.