Please report security issues privately rather than in a public issue: open a GitHub security advisory.
Include what you found, how to reproduce it, and what an attacker could do with it. You will get an acknowledgement within a few days. Please give us a chance to ship a fix before publishing.
DevBox is a static page with no backend and no accounts, so there is no server to breach and no database to leak. The interesting risks are different:
| Risk | Mitigation |
|---|---|
| Data leaving the machine | There is no DevBox server. The only outbound request the app can make is one you explicitly build in the HTTP tool, to an address you type, and it is shown to you first. |
| XSS via pasted content | The Markdown renderer escapes all HTML rather than executing it, and restricts URLs to http, https, mailto, tel and relative paths. Syntax highlighting builds DOM nodes with textContent, never HTML strings. The one place innerHTML is used (the Markdown preview and the generated QR SVG) receives strings this codebase produced itself from escaped input. |
| Scheme smuggling | URL sanitisation strips control characters before checking the scheme, so java\0script: and java\tscript: do not survive. |
| Secrets written to disk | The HTTP tool redacts Authorization, Cookie, X-API-Key and similar headers before saving history; the JWT tool stores a 24-character fingerprint instead of the token. History can be turned off entirely, and erased from Settings. |
| Supply chain | Zero dependencies. CI fails the build if any import points outside the repository, so no CDN script or npm package can appear without review. |
| SSRF via the optional proxy | See below. |
| Denial of service against yourself | The JSON parser caps nesting depth, the regex tester caps match count and warns about catastrophic patterns, response bodies and file reads are size-capped. |
server/proxy.mjs is off by default and must be started deliberately. Because it fetches URLs on
someone's behalf, it is the one genuinely dangerous component, and it is written accordingly:
- binds to
127.0.0.1only; - accepts
httpandhttpsonly; - resolves the target hostname and rejects every loopback, private (RFC 1918), CGNAT, link-local
(including
169.254.169.254), multicast, documentation and reserved address, in IPv4, IPv6, IPv4-mapped, 6to4 and NAT64 forms; - refuses
localhost,*.local,*.internal,*.home.arpaandmetadata.google.internalby name; - pins the connection to the address it validated, closing the DNS-rebinding window between check and connect;
- follows redirects manually, re-validating every hop, with a hard limit;
- strips hop-by-hop headers, rejects CR/LF in header values, caps request and response size, times out;
- only accepts requests from configured local origins.
DEVBOX_ALLOW_PRIVATE=1 disables the address checks. It exists for local API development and logs a
warning at startup. Do not run the proxy on a shared or public host, and do not expose it to a network
you do not control.
- It does not verify JWT signatures. Decoding is not verification, and the UI says so. Never treat a decoded token as trustworthy.
- It does not encrypt anything. MD5 and SHA-1 are provided because published checksums still use them; both are labelled as broken or legacy.
- It does not sanitise for your app. The Markdown renderer is safe for DevBox's own preview. If you copy the generated HTML into another application, apply that application's own sanitiser.
The latest release on main is supported. DevBox has no build artefacts, so "upgrading" is pulling the
repository.