NNuvaka General AppDeveloper docs
TRDownload

Nuvaka › Developer docs › Security rules

Security rules

nuvaka-ext lint and the server's upload scan apply the same rules, in the same order, with the same messages. An error rejects the package; a warning is only reported.

Package

RuleLimit
FormatZIP (.nvx), nuvaka.json at the root
Compressed size≤ 20 MB
Unpacked size≤ 60 MB
Number of files≤ 2000
Path≤ 200 characters; no absolute paths, .., :, empty segments or segments starting with a dot (except .well-known)
Symbolic linksforbidden
Allowed file typeshtml htm js mjs css json svg png jpg jpeg gif webp avif ico woff woff2 ttf otf txt md map wasm — no executables (exe, dll, so, dylib, sh, bat, ps1…). wasm is allowed (it runs inside the engine).

Forbidden code patterns

Searched in every .js, .mjs, .html and .htm file; for each rule the first match per file is reported with its line number. All of them are errors.

PatternWhy
eval(running code from a string
new Function(building code from a string
Function("…")building code from a string
setTimeout("…"), setInterval("…")a timer given a string is a hidden eval; pass a function
import("https://…")loading a module from a remote address
importScripts(loading remote scripts
<script src="https://…">, src="//…"remote script; put the code in the package
document.cookiecookie access
window.parent, .top, .opener (also via globalThis/self)access to the parent window; use nuvaka.*
names like _0x1a2b (more than 30)obfuscated code; minified code is fine

Warning: a minified file larger than 200 KB with fewer than 5 lines and no source map (a matching .map file or sourceMappingURL). It makes review harder; include the .map file.

Comments are scanned too

The scan works on text; eval( or nuvaka.mail in a comment or HTML text counts as well. Do not leave sample code in comments.

Permission and usage matching

  • A namespace used in code as nuvaka.<name>, nuvaka["<name>"] or { <name> } = nuvaka without its permission in the manifest → error (the message reads, in Turkish, "nuvaka.pool is used but the manifest has no nuvaka.clipboard permission").
  • nuvaka.ui.notify used without the notifications permission → error.
  • A permission requested in the manifest but never used in code → warning ("asking for unneeded permissions scares users").

Namespace ↔ permission mapping: Permissions.

Manifest

Schema and extra rules: Manifest reference. Unknown fields, missing required fields, entry/icon paths not in the package, invalid schedules, duplicate permissions or another user's prefix → error.

Runtime limits

The scan is best effort. The real security boundary is at run time:

  • Every call is checked again in the app and on the server, with the extension ID the shell knows and the permissions granted.
  • The UI is sandboxed: no same-origin, connect-src 'none', no remote scripts, no access to the parent window.
  • Background: QuickJS, 32 MB memory, 5 s continuous execution slice, no eval/Function.
  • net: https only, only allowed full host names, private network addresses rejected.
  • files: only folders the user picks; escaping the root is rejected.
  • Critical permissions are confirmed on every use; notifications and calls are rate limited; a summary of every server call is recorded.

Good practice

  • Ask only for permissions you actually use; write concrete reasons ("To read release information from GitHub").
  • Avoid combining reading permissions with net; if you must, explain in the reason which data goes where.
  • Render user data (note content, mail, files) with textContent, not innerHTML.
  • Do not embed secrets (API keys) in code; take them from the user as a setting or keep them in storage.
  • Handle permission_required, permission_denied, notify_limit and version_conflict on every call.

Nuvaka Apps API v1 · last updated 2026-09-27