Security

Report security problems privately to security@osanimator.com. Please don't open a public issue.

How the player keeps pages safe

• A movie is data, not code. Version 0.1 has no scripting: actions are a fixed list (stop, play, go to a frame, announce).
• Text from a movie never becomes markup.
• Colours must be plain colours, so a movie can't make the browser load an address.
• Every field is checked before anything is drawn. A movie that would put more than 5,000 objects on stage, or that nests symbols in a loop, is refused.
• If anything fails while playing, the player stops and shows the page's fallback content.
• The player works on pages with a strict Content-Security-Policy. This site runs under one.

The tests for each of these are in SECURITY.md.