Hi Joe, Looks good to me overall. Just a few thoughts, unless I'm missing something.
For mod_lua, I don't think server/thread scopes are actually documented as not thread-safe. My understanding is that the main concern is state surviving across requests. I'd also be a bit cautious about excluding all memory corruption involving persistent scopes. For mod_heartmonitor, if I'm reading the code correctly, there's also an HTTP "heartbeat" handler accepting POST requests. Perhaps the trust boundary should mention that entry point too? Otherwise, the hcheck and proxy_beacon parts look reasonable to me. Regards, Arturo On Mon, Oct 26, 2026 at 10:47 AM Joe Orton <[email protected]> wrote: > Hi folks, > > I'm proposing some more words to head-off LLMs before/after they reach > security@ with a clearer description of the security model for specific > modules. I'd appreciate review particularly: > > 1) for mod_lua, I think we should be explicit that random module bugs > (crashes, leaks etc) are outside the security model. It is too easy for > LLMs to jump from remote unauthenticated client runs Lua script X, X has > crash/bug/leak/whatever -> vulnerability - that isn't a sensible or > sustainable model. > > 2) mod_proxy_hcheck/mod_proxy_beacon and mod_heartmonitor - is this all > correct? > > Regards, Joe >
