WebContainer Security Review

Overview

This skill produces a repo-grounded threat model and bounded hardening plan. Browser containment reduces host risk, but it does not make user code trustworthy, prevent all network activity, protect secrets mounted into the runtime, or replace host-page CSP and data-governance controls.

Prerequisites

• A named application, data classification, and intended code/dependency sources
• Identified owners for the host page, runtime lifecycle, auth, preview, persistence, and deployment headers
• Permission to inspect security-sensitive configuration without reading secret values

Tool Discipline

Use Read, Glob, and Grep to trace input, filesystem, process, dependency, network, preview, auth, CSP, and persistence paths. Use WebFetch only for current official StackBlitz or WebContainers documentation. Use Write for an approved threat model and Edit only for narrow reviewed controls.

Current Contract