Updating core-concepts/README.md

[jschalz]

No description provided.

[dryrunsecurity]

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security	Status	Findings
Configured Codepaths Analyzer	✅	0 findings
Secrets Analyzer	✅	0 findings
Authn/Authz Analyzer	✅	0 findings
AppSec Analyzer	✅	0 findings
Sensitive Files Analyzer	✅	0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖.
Note that this summary is auto-generated and not meant to be a definitive list of security issues
but rather a helpful summary from a security perspective.

Summary:

The changes in this pull request appear to be focused on improving the documentation for Bulwark's core concepts, providing more detailed information about the application's architecture and security-related design decisions. From an application security perspective, the key points to highlight are the use of sandboxed guest environments, the adoption of WebAssembly (WASM) for plugin isolation, and the quantitative decision-making process for managing plugin interactions.

The sandboxed guest environment and the use of WASM are positive security measures that help to constrain the execution of user-supplied plugins and reduce the potential attack surface. However, it is important to ensure that any third-party WASM modules are carefully reviewed for security vulnerabilities. Additionally, the decision-making process based on accept, restrict, and unknown values is a more nuanced approach compared to a simple "allow" or "deny" model, but the combination of these decision values into a final score should be reviewed to ensure it aligns with the desired security posture. Finally, the ability to allow plugins to extract, store, and retrieve information on a per-request basis could potentially introduce security risks if not properly managed, and the types of information that plugins are allowed to access should be carefully considered and secured.

Files Changed:

• introduction/core-concepts/README.md: This file has been updated to provide more detailed information about Bulwark's architecture, the use of WebAssembly (WASM) for plugin isolation, and the decision-making process within Bulwark. The changes highlight the key security-related aspects of Bulwark's design, such as the sandboxed guest environment, the use of WASM for plugin isolation, and the quantitative decision-making process for managing plugin interactions.

Powered by DryRun Security