Security model

The sandbox

Each Mini Program runs in an iframe with sandbox="allow-scripts" (an opaque origin) and a Content Security Policy of default-src 'none' plus inline script and style. That means:

• no network requests of any kind,
• no cookies or browser storage,
• no access to the Lex page around it.

The bridge

The host transfers a MessagePort into the iframe. @lex/sdk talks only over that port. The host forwards each request to the API, which checks, on every call:

1. the user's session and workspace,
2. the runtime session (one per open Mini Program; it ends after an hour or when closed),
3. that the capability is in the reviewed, approved manifest of the version that is running,
4. rate limits (2,000 calls per session) and the workspace's usage budget.

Checks inside the SDK only exist to give developers quick feedback. The API is the authority.

Data

• Storage is scoped to workspace + user + Mini Program. One Mini Program can never read another's data, or another user's.
• getContext() exposes only the user's id and display name, never an email, workspace id or token.
• The assistant answers Mini Programs without tools, so a Mini Program can't act on anyone's connected accounts.

Integrity

Published bundles are stored once and verified by SHA-256 each time they are served. A tampered bundle is never run.