Archify
Archify: seguridad y operaciones de JSON, fuentes, HTML/SVG y CI
Protege entradas no confiables, enlaces, exports, permisos de CI, egress, recursos y rollback.
Qué aprenderás
- Threat-model Archify inputs and exports
- Design least-privilege CI operations
- Govern semantic claims and incident rollback
Antes de empezar
- Basic Git and command-line usage
- Comfort reading a project README
You can explain the project, run its documented first step, and decide what to verify before adopting it.
Conclusiones clave
- Typed JSON, source links, and generated HTML/SVG all need input validation.
- Isolate rendering, restrict egress, and run CI with read-only least privilege.
- Review semantic claims and keep rollback and redacted incident evidence.
Treat authored and agent JSON as input
JSON generado, enlaces de fuente y HTML/SVG autocontenido son límites no confiables. Valida schema, URLs, IDs y tamaños, aísla el renderer, restringe egress, usa tokens de solo lectura y conserva last-good, checksums y trazas redactadas para incidentes.
A source trace should link to an expected, reviewable location. Reject unexpected schemes, path traversal, and links that escape the evidence boundary. If a diagram is public, redact secrets and private topology before rendering rather than relying on viewers not to inspect the HTML.
Harden HTML, SVG, and motion
Self-contained HTML/SVG is convenient but executable. Escape text and attributes, sanitize or remove embedded scripts, restrict external requests, and set safe download content types. Treat finite motion and interaction handlers as code paths that deserve tests, not decoration.
Render in an isolated process with bounded CPU, memory, and output size. A malicious label or graph should fail closed with a clear validation error instead of consuming an unbounded CI runner or producing an artifact that phones home.
Operate CI with least privilege
The generation job usually needs read-only source access and a dedicated artifact directory. Do not grant repository write tokens or cloud credentials to a diagram renderer unless a separately reviewed publishing step requires them. Record skill revision, input revision, validation status, export checksum, and external-request policy in build metadata.
Keep last-good output and a rollback revision. If a new skill or fixture exposes sensitive data, stop publication, remove the artifact from distribution, rotate only affected credentials, and preserve a redacted trace for the incident review.
Govern the meaning, not only the bytes
Security controls cannot prove that a topology is complete or that a source edge is semantically correct. Require a reviewer to approve high-impact diagrams, document unresolved facts, and keep a distinction between observed code, authored assumptions, and generated suggestions. Add regression fixtures for injection text, unsafe URLs, duplicate IDs, and oversized graphs.
Cómo elegir
| Criterio | Opción A | Opción B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Pasos de implementación
- 1
Validate JSON fields, URLs, IDs, lengths, and relationship counts.
- 2
Escape/sanitize HTML and SVG and bound renderer resources.
- 3
Use read-only CI credentials and record revisions, policies, and checksums.
- 4
Rehearse publication stop, selective credential rotation, rollback, and review.
Ejemplo para copiar
archify_security:
input: schema_and_length_validated
source_links: [https_only, allow_list]
renderer: isolated
external_requests: disabled_by_default
ci_token: read_only
artifact: last_good_on_failurePreguntas frecuentes
Is self-contained SVG automatically safe?
No. Escape content, sanitize attributes/scripts, restrict external requests, and test untrusted labels and links.
Should the renderer have repository write access?
Normally no. Give it read-only source access and publish artifacts in a separately reviewed step.
Fuentes
- Archify README (captured 2026-08-31)Fuente verificada 2026-08-31
- Archify repositoryFuente verificada 2026-08-31