Canonical Wago documentation
Security and isolation status
What Wago currently bounds, how runaway guest execution is interrupted, and which security assurances are not yet published.
Published controls
- Declared linear-memory maxima can be limited at instantiation; the table policy currently checks initial/minimum entries only.
- Explicit bounds checks are the default; signal-backed guard pages are an opt-in build/runtime path with native CI coverage.
- Context cancellation and deadlines interrupt amd64/arm64 native guest code at function-entry and loop-header safepoints.
- Capability policy can allow or deny plugin-provided host access.
- The repository contains Go fuzz targets and 71 pinned wazero fuzz-regression fixtures with ordinary test oracles.
Evidence: README · public API source · feature matrix · native CI matrix
Not currently published
- No dedicated
SECURITY.mdor public vulnerability-reporting address was found at this source commit. - No third-party security audit is claimed.
- No runtime-wide aggregate memory budget across all live instances is documented.
- No deterministic instruction-fuel accounting is documented; deadlines are cooperative safepoint interruption, and
Policy.MaxInvokeDurationis reserved rather than enforced. - No stable compiled-artifact compatibility guarantee across releases is documented.
For hostile multi-tenant workloads, these gaps should be part of the deployment threat model. Process or container isolation remains an additional defense boundary, not something the engine can make unnecessary.