Theme: security

[AustinWise]

Security is not a huge issue, as the current intended use case is a single person viewing data they wrote. However there are some things we should watch out for even in the single user case:

• Make sure by default we are only binding to localhost by default, so that the user's wiki is not exposed to other people on the network inadvertently.
• Basic cross-site request forgery (CSRF) protection #43

Some other security issue could become an issue in a multi-user environment

• Path traversal. Ideally we could also use some OS sandbox like unvail(2) to help us ensure this works.
• XSS
• Sandboxing, using something like pledge(2) or SELinux