Application security
This page covers how untrusted models and third-party packages are constrained: signed platform → app calls, signed Marketplace packages, capability gates, and agent threat reduction.
App-builder contract: Developer security. Package rules: Solution security. Agent threat model: AI Agent Security.
Short definition (citation-ready)
Qefro authenticates platform invokes to
/qefrowith HMAC-SHA256 over timestamp and raw body, verifies Marketplace packages with Ed25519, rejects arbitrary JavaScript in solution packages, and mediates host capabilities on every call. Prompt injection is not “solved”; blast radius is limited with isolation, least-privilege tools, SSRF controls, and logs.
HMAC /qefro protocol
Platform → application calls (external SDK Connection and managed apps) use a shared signing secret:
payload = "v1:" + unix_timestamp + ":" + raw_request_body
signature = "v1=" + hex( HMAC_SHA256(signing_secret, payload) )
Headers: X-Qefro-Signature, X-Qefro-Timestamp, X-Qefro-Protocol. Default maximum timestamp skew is 300 seconds. Failed verification returns HTTP 401 invalid_signature.
The end user never holds this secret. Details: Authentication.
Tenancy headers and platform.* bindings are injected by Qefro. Applications must not trust client-supplied tenant ids over platform context.
Marketplace supply chain
| Control | Enforcement |
|---|---|
| No arbitrary JavaScript | Packages are YAML, JSON, and images; script / js kinds rejected at publish |
| No iframe / DOM runtime in the package | Portal components render UI; no package-side browser VM |
| Signing | Ed25519 over id|version|checksum; registry verifies on store; installer re-verifies |
| Immutability | Published versions do not change |
| Capability mediation | Declared at install; re-checked on every gated call |
| Catalog writes | Restricted to platform admins (QEFRO_PLATFORM_ADMIN_IDS) |
Business Tools vs SDK apps
| Path | Trust | Your job |
|---|---|---|
| REST / OpenAPI tool | Qefro holds the service credential; model supplies arguments | Validate arguments on your API; least privilege; identify() |
External /qefro app | Privileged peer — tool outputs are trusted by the assistant | Protect the webhook URL; rotate HMAC secret; no SSRF from your outbound calls |
| Managed Marketplace app | Same protocol; platform injects secrets and storage scope | Least capabilities; no cross-tenant in-memory state |
Treat the model as untrusted input to the tool layer in all three cases.
Prompt injection
No vendor can honestly claim to prevent all prompt injection. Qefro reduces impact by:
- Workspace-scoped retrieval (hostile docs cannot search another workspace’s index)
- Tool allowlists and auth levels (
public/verified_channel/organization_challenge) - SSRF-blocked egress
- Encrypted, non-prompt-resident secrets
- Execution and identity logs
Assume uploaded documents and user messages are hostile when write tools are enabled.
Workflow
Ship an app without widening the blast radius
- Declare minimum capabilities — Install wizard shows tenants exactly what you asked for.
- Keep secrets out of the package — Packages are global and signed; no tenant URLs or keys in YAML.
- Validate tool arguments — Schema + server-side checks; never trust LLM JSON alone.
- Major-version permission changes — Adding customer.read or new connectors is a breaking trust event.
- Review tool logs after install — Unexpected invokes are incidents.