Security model

Use contract scope by default

Declare the domain contracts the application understands and request only the operations needed for the current feature. Contract scope confines records to types that provide those contracts. Use full_collection only for genuine collection tools.

Choose a storage boundary deliberately

Web-browser defaults retain authorization in localStorage and relay keys as non-extractable IndexedDB keys. A portable manifest opened from file:// uses process-memory token and key storage instead. Applications with another isolation boundary can supply a custom Storage and GrantKeyStore. Native shells should use platform-protected application storage where possible.

Store Connect refresh credentials, hosted provider capabilities, and mirror replica tokens in application-protected storage outside the collection.

Keep origins and callbacks exact

• Production homepage, icon, and browser callbacks use HTTPS.
• Browser callbacks stay on the manifest homepage origin.
• Native callback schemes match or extend the reverse-domain application ID.
• PKCE remains mandatory for browser and native authorization.
• The loopback connector validates the exact approved browser origin.
• Portable files declare no web origin and use a key-bound short-code flow.

Treat downloaded application code as authorized code

Every local file has the opaque browser origin null. Connect does not trust that origin by itself. For a local grant, the connector also requires the P-256 application key and encrypted relay envelope. For a hosted grant, the provider requires a short-lived bearer capability scoped to one grant, collection, operation set, record scope, expiry, and that exact opaque origin. Both refresh credentials and provider capabilities remain in process memory for file://.

Code already running in an approved page has that page's access. Keep untrusted scripts out of the file, pin every CDN dependency to an exact version with Subresource Integrity, and expect reauthorization after reload.

Understand each payload boundary

Application release checklist

• Validate the production manifest with default settings and omit --allow-local.
• For portable files, test popup blocking, expiry, cancellation, reload, a second unrelated local file, and both local and hosted collection routes.
• Pin portable CDN assets to exact versions and verify their SRI values.
• Test narrowing, pause, revocation, token rotation, and reauthorization.
• Test direct-to-relay failover and verify one durable mutation outcome.
• Pass revisions on every destructive or overwriting operation.
• Present preflight reference impact before rename and delete.
• Keep notification presentation free of private interpolated content.
• Deduplicate signed webhook deliveries before side effects.
• Document the hosted provider as a trusted data processor.