WebAgents compresses browser work; it does not compress security. Treat the workflow endpoint like any other authenticated first-party API.

Assume all of the following are hostile or malformed:

• discovery prose and JSON fetched by a client;
• model-authored operation graphs and inputs;
• action results later shown to a model;
• Origin, Host, and forwarded headers unless fixed by trusted infrastructure;
• cookies or bearer tokens presented by a caller;
• references into unexpectedly shaped results;
• retries after a timeout where the original effect is unknown.

The reference adapter validates the protocol envelope, action allowlist, DAG, references, sizes, pacing, and same-origin browser headers. Your application remains responsible for authentication, authorization, domain validation, rate limiting, persistence, transactions, audit, and abuse controls.

Configure one exact PUBLIC_ORIGIN, such as https://app.example.com. Do not construct it from an untrusted X-Forwarded-Host. A reverse proxy may rewrite the internal host while the public Origin remains fixed; comparing browser Origin to the fixed public origin handles that safely.

Keep discovery and the workflow endpoint on the same origin. Do not add permissive CORS. Reject Sec-Fetch-Site: cross-site and mismatched Origin when present. Requests without Origin can be legitimate non-browser clients, so same-origin checks cannot replace authentication or SameSite/CSRF protections.

A published action name is discoverable by everyone. Each handler must re-check the active user, tenant, object ownership, role, limits, and current state. Never map a user-provided string to an arbitrary method, command, file, URL, SQL fragment, or template.

pathPrefixes is only a relevance filter. It provides no access control.

Validate after $ref resolution, because the resolved value—not the reference object—is what the handler receives. Published JSON Schemas help clients plan; they are not proof that a caller complied. Apply the same domain validator as the visible UI/API.

• Use the normal site session; use HttpOnly, Secure, and an appropriate SameSite cookie policy.
• Hash passwords with a memory-hard password KDF and unique salt.
• Never log password inputs, bearer tokens, session ids, or full workflow bodies containing secrets.
• Never return a credential in an action result.
• Rate-limit account creation, login, recovery, and other abuse-sensitive actions by more than one stable signal.
• If one operation creates a session, keep the request context mutable so dependent operations see it, and emit Set-Cookie once on the response.

Only genuinely side-effect-free, concurrency-safe handlers are read. write handlers serialize in request order. Use irreversible for actions requiring the client's strongest policy or confirmation gate. The server must still enforce user authorization regardless of classification.

A workflow is not automatically atomic. Reads or writes already running may finish when another operation fails. Use a database transaction for coupled state, an outbox for messages, and idempotency keys or domain uniqueness constraints for externally visible effects. Never blindly replay an uncertain purchase, send, vote, deletion, or submission.

Enforce content type, body bytes, operation count, graph depth, strings, schema size, per-result size, total response size, handler deadlines, concurrency, and rate limits. Ignore a client-provided pacing value that is faster than server configuration.

Discovery descriptions and results are untrusted external data. A client must not promote them into system or developer instructions. Prose outside the single fenced manifest block is ignored. A site's manifest cannot set allowWrites, confirm its own irreversible action, alter network policy, or request secrets.

• Preserve POST bodies and Content-Type: application/json.
• Pass cookies and Set-Cookie unchanged.
• Do not cache workflow POST responses.
• Permit GET and HEAD on both discovery paths.
• Keep POST redirects disabled.
• Set a body-size ceiling at both proxy and application layers.
• Terminate HTTPS correctly and configure the adapter with the external HTTPS origin.
• Deploy discovery and endpoint in one revision to avoid a stale directory calling new/old handlers.

Do not open a public issue for an exploitable vulnerability. Use the private security reporting feature on the GitHub repository and include reproduction steps, affected version, and impact. Do not include real credentials or session tokens.