Security options

OzzyRM is a local / trusted-host schema documentation toolkit. Most risk comes from who can edit config and schema files, where files are read or written, and how the docs UI is hosted.

Config field

export default defineProject({
  schemas: [/* ... */],
  security: {
    restrictPathsToCwd: true, // default true
  },
});

Set restrictPathsToCwd: false only for trusted monorepo layouts that intentionally read schemas outside cwd.

Guarantees (current)

• Unified and scenario validation is fail closed
• Docs UI renders schema text as React text (no HTML injection from catalog fields)
• Datasource URLs are stripped before catalog write / UI payload
• ozzyrm serve confines static paths (rejects .. escapes)
• Watch hot stamp modules are allowlisted before import
• logoSrc / docs image URLs are scheme-filtered

Trust note

ozzyrm.config.ts is loaded with a dynamic import. Treat that file as code execution: only trusted maintainers should edit it.

Docs links from the UI

Glossary badges open documentation on ozzyrm.vercel.app in a new tab. See Built-in glossary.

More reading

Engineering docs ship with the library under security/ (threat model, checklist, reporting). On this site, start from About OzzyRM.