Security Notes

Ask's private-document path combines local extraction, content-addressed retrieval, and filename/chunk citations. Browser isolation, dedicated workers, sandboxed iframes, a Content Security Policy, COOP/COEP headers, and API request controls are layered guardrails—not proof that a model answer or generated program is safe or correct.

IndexedDB

Boundary: Conversations and document chunk/vector cache data stay in the browser origin. Memories are saved and retrieved only while Memory is enabled.
Main risk: Any same-origin XSS could read local app data. Browser profile compromise is also out of the app's control.
Mitigation: Storage failures are announced without echoing content. Clear controls remove each owned database, but browser storage is not a defense against same-origin script.

RAG identity and deletion

Boundary: A local SHA-256 digest of file bytes keys vector records and deduplicates identical content. Removing or clearing waits for IndexedDB to commit before updating the UI.
Main risk: Cached chunks include extracted document text. A browser can evict records, and an exact commit/ack failure can still require a retry or reattachment.
Mitigation: Legacy metadata-derived cache keys are purged on schema upgrade. RAG timeouts terminate the worker so it cannot continue a reported-failed mutation in the background.

Generated Markdown

Boundary: Remote images are blocked by default. External links require a click and open with noopener/noreferrer.
Main risk: After Load once, the image host receives a network request and can observe connection metadata. Links can lead to untrusted sites.
Mitigation: Each remote image needs a per-image approval and then loads without cross-origin credentials or a referrer. The UI shows the destination host before approval.

Artifact iframes

Boundary: Generated HTML previews run in opaque-origin sandboxed iframes. Their embedded CSP sets connect-src 'none' and blocks forms, frames, objects, and non-data media.
Main risk: Previewed code can still run JavaScript, consume CPU or memory, render deceptive content, or attempt to navigate its own frame to an external destination.
Mitigation: Artifacts get no same-origin access to Ask, and the CSP blocks ordinary subresource and connection paths. This is not a zero-network guarantee; review code before previewing or copying it.

Content Security Policy

Boundary: A CSP restricts framing, objects, base URLs, forms, and resource origins.
Main risk: WASM and supported runtimes still require inline/eval script modes and broad configured connection targets.
Mitigation: CSP is defense in depth, not an isolation guarantee. Artifact iframes remain sandboxed without same-origin access.

Surface	Boundary	Main risk	Mitigation
IndexedDB	Conversations and document chunk/vector cache data stay in the browser origin. Memories are saved and retrieved only while Memory is enabled.	Any same-origin XSS could read local app data. Browser profile compromise is also out of the app's control.	Storage failures are announced without echoing content. Clear controls remove each owned database, but browser storage is not a defense against same-origin script.
RAG identity and deletion	A local SHA-256 digest of file bytes keys vector records and deduplicates identical content. Removing or clearing waits for IndexedDB to commit before updating the UI.	Cached chunks include extracted document text. A browser can evict records, and an exact commit/ack failure can still require a retry or reattachment.	Legacy metadata-derived cache keys are purged on schema upgrade. RAG timeouts terminate the worker so it cannot continue a reported-failed mutation in the background.
Generated Markdown	Remote images are blocked by default. External links require a click and open with noopener/noreferrer.	After Load once, the image host receives a network request and can observe connection metadata. Links can lead to untrusted sites.	Each remote image needs a per-image approval and then loads without cross-origin credentials or a referrer. The UI shows the destination host before approval.
Artifact iframes	Generated HTML previews run in opaque-origin sandboxed iframes. Their embedded CSP sets connect-src 'none' and blocks forms, frames, objects, and non-data media.	Previewed code can still run JavaScript, consume CPU or memory, render deceptive content, or attempt to navigate its own frame to an external destination.	Artifacts get no same-origin access to Ask, and the CSP blocks ordinary subresource and connection paths. This is not a zero-network guarantee; review code before previewing or copying it.
Content Security Policy	A CSP restricts framing, objects, base URLs, forms, and resource origins.	WASM and supported runtimes still require inline/eval script modes and broad configured connection targets.	CSP is defense in depth, not an isolation guarantee. Artifact iframes remain sandboxed without same-origin access.

HTML and JavaScript previews run in opaque-origin sandboxed iframes whose CSP blocks ordinary network subresources and connections, but same-frame navigation remains a residual network path.