Skip to content

Update security docs#3173

Merged
texodus merged 1 commit into
masterfrom
thread-model
May 16, 2026
Merged

Update security docs#3173
texodus merged 1 commit into
masterfrom
thread-model

Conversation

@texodus
Copy link
Copy Markdown
Member

@texodus texodus commented May 16, 2026

This PR updates the project's documentation to add security details to WebSocketServer, tornado.py, starlette.py and aiohttp.py:

  • Perspective's built-in Web Socket handlers are reference integrations with no authentication, authorization, origin enforcement, or rate limiting, and are not safe to expose to untrusted networks.
  • Perspective's Client/Server relationship is not a security boundary, and any connected Client is expected to have the same inherent permission as the Server it is connected to.

These were (I hope) already implicitly understood (and referenced in various places in the existing docs), but are now explicitly documented in the FAQ and SECURITY.md.

Signed-off-by: Andrew Stein <steinlink@gmail.com>
@texodus texodus added the documentation Improvements/bugs/changes to documentation label May 16, 2026
@texodus texodus requested a review from timkpaine May 16, 2026 02:08
@texodus texodus merged commit 048a0cf into master May 16, 2026
16 checks passed
@texodus texodus deleted the thread-model branch May 16, 2026 02:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements/bugs/changes to documentation

Development

Successfully merging this pull request may close these issues.

2 participants