Development debugging services
DevTools is a privileged interface that can read DOM, logs, network data and scripts. Do not expose it unconditionally in a distributed app. Use a controlled tunnel for remote debugging, and keep connection tokens out of logs and feedback files.
Keep three trust boundaries explicit
Display user input as text, defining allowed tags and attributes separately if HTML is required. Expose only the native operations Lua needs. Keep debugging local to development and exclude authenticated connection URLs from logs.
Handle files and external resources deliberately
Validate size, type and allowed scope before reading user-selected paths. Do not execute downloaded content as trusted HTML or script. Keep credentials out of HTML, Lua and downloadable UI bundles; the host defines network and storage policy.
Something unclear?
Report an issue on this page →