Current boundary
LobeWork stores validated manifests, permissions, versions, publisher state, accesss, and contribution metadata.
Blocked execution paths
Third-party JavaScript, native modules, shell commands, package installers, and remote scripts are not executed.
Future package trust
Executable packages would require signatures, immutable hashes, publisher identity, revocation, advisories, and rollback.
Future process isolation
A sandboxed host, capability-scoped IPC, crash isolation, resource limits, and restricted filesystem and network access would be required.
Developer mode remains deliberate
Local-manifest testing should never silently weaken production security or convert an untrusted package into an official publisher.
NEED A GUIDED ANSWER?
Ask LobeWork about this guide.
Ask LobeWork uses the same published article library and links back to its source guidance.
WAS THIS GUIDE HELPFUL?Help us improve the documentation.