Security policies

nax loads workflow files and nax.config.* files through Configorama safe mode. Static JavaScript and TypeScript object exports are parsed as JSON5-compatible data; project code is never executed while workflows are discovered.

The internal loader is equivalent to:


import path from 'node:path'
 
const configPath = path.resolve('flow.yml')
 
await configorama(configPath, {
  safeMode: true,
  allowedFileRoots: [path.dirname(configPath)]
})

Setting	Default	Purpose
`safeMode`	`true`	Enables safe inspection and blocking policy while `nax` loads configs.
`allowedFileRoots`	config directory	Roots for file/text references.
`restrictFileRoots`	`true`	Blocks traversal outside allowed roots.
`blockExecutableFiles`	`true`	Blocks JavaScript, TypeScript, ESM, and CJS execution. NAX parses static object exports before entering Configorama.
`blockCustomResolvers`	`true`	Blocks user resolver code.
`blockCustomFunctions`	`true`	Blocks user function code.
`blockDotEnv`	`true`	Blocks dotenv mutation.

Use YAML, JSON, TOML, or a static JavaScript/TypeScript object export for project workflows and project flow-root discovery. Static module files must contain only one of these shapes:


module.exports = { flowsDirs: ['.github/nax-flows'] }


export default { flowsDirs: ['.github/nax-flows'] } as const

Imports, variable declarations, function calls, computed values, and exported functions remain blocked.

eval(...) and if(...) are sandboxed data-flow expressions in Configorama, so safe mode does not treat them like executable config. Prefer YAML, JSON, or TOML for dynamic data-flow expressions.

Security policies

See also