From ad98d1f32925b221d3a8ba87f9d9a9528bcfcb0f Mon Sep 17 00:00:00 2001 From: Tobi Lutke Date: Wed, 11 Mar 2026 08:26:40 -0400 Subject: [PATCH] add security constraint to autoresearch.md, fix strict mode gate --- auto/autoresearch.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/auto/autoresearch.md b/auto/autoresearch.md index a07a4b43..fd10cda0 100644 --- a/auto/autoresearch.md +++ b/auto/autoresearch.md @@ -34,6 +34,10 @@ then the performance benchmark, outputting metrics in parseable format. - liquid-spec failures must not increase beyond 2 (pre-existing UTF-8 edge cases) - No new gem dependencies - Semantic correctness must be preserved — templates must render identical output +- **Security**: Liquid runs untrusted user code. Never use eval, send on user input, + dynamic method dispatch, const_get, or any pattern that could let template authors + escape the sandbox. All optimizations must use safe byte-level scanning with explicit + character checks only. ## Baseline - **Commit**: 4ea835a (original, before any optimizations)