understanding-tauri-ecosystem-security

Run cargo audit for Rust dependencies and npm audit for Node.js dependencies to identify known vulnerabilities. For deeper supply chain analysis, use cargo vet to verify dependencies against trusted sources or cargo crev for community code reviews.

Set the csp field under app.security in the Tauri configuration, restricting default-src to 'self' and only whitelisting trusted hosts. Avoid remote CDN scripts, and include 'wasm-unsafe-eval' in script-src if using WebAssembly frontends.

Permissions define explicit privileges for frontend command access, while capabilities grant those permissions to specific windows or webviews. Command scopes add granular allow and deny rules, with deny rules always superseding allow rules.

Report privately via GitHub Private Vulnerability Disclosure or email [email protected]. Never disclose through pull requests, issues, Discord, or forums; the team follows a 90-day coordinated disclosure standard.

Capabilities do not protect against malicious Rust backend code, overly permissive scopes, WebView zero-day vulnerabilities, or supply chain attacks. They only minimize frontend compromise impact and prevent privilege escalation through the IPC layer.

Only Tauri versions greater than 1.0 receive security support. Earlier versions receive no security updates, so upgrading to a supported release is required for patches.