Security & Permissions

There is no kaba.security namespace. Security-related calls live in kaba.core. This page explains the SDK’s security model and lists those calls in one place.

Who gets the SDK

Page	`window.kaba`
A built-in `kaba://` page, top frame	Yes: the full SDK.
A `kaba://` page inside an iframe	No.
An `http://` or `https://` website	No.

The SDK is injected through Electron’s context bridge into an isolated world. Page scripts receive a frozen object of functions; they cannot reach Node.js, Electron, or the bridge itself.

The rule that only the top frame gets the SDK is deliberate. If iframes received it, a hostile website could embed a kaba:// page and borrow its privileges.

Two more objects exist on kaba:// pages for specific apps: window.experimental (a cross-origin GET/HEAD fetch and page capture) and window.electronAPI (wallpaper and resource usage helpers).

What websites get instead

Websites get the web platform, with Kaba’s privacy layer applied, and nothing more. A site that wants a capability asks through the standard web API, and Kaba shows a permission prompt.

The permission catalogue

Permission	Asked when a site wants to
Camera and microphone	Capture audio or video
Location	Read your position
Notifications	Show notifications
MIDI, MIDI system-exclusive	Use MIDI devices
USB, Serial, HID, Bluetooth	Talk to a device. You pick the device from a chooser.
Protected media	Play DRM-protected content
Pointer lock, keyboard lock	Capture the pointer or keyboard
Fullscreen	Go fullscreen
Downloads	Download files
Open external	Open another application

Decisions are stored per site. Review them in the site panel or under Settings → Sites. Under Lockdown, sensor and device requests are denied without asking.

All on kaba.core.

Permissions

Method	Purpose
`getPermissions()`, `getPermission()`	Read decisions.
`setPermission()`, `clearPermission()`, `clearPermissionAllOrigins()`	Change them.
`getDefaultDenials()`	What is denied by default.
`clearAllSiteData()`	Remove everything stored for a site.

Privacy

Method	Purpose
`privacyPolicy()`	The global policy in force.
`privacySiteStatus()`	Effective settings and overrides for a site.
`privacyAllowThirdPartyCookies()`, `privacyThirdPartyCookiesAllowed()`	Third-party cookies for a site.
`privacySetSiteFingerprint()`, `privacyPauseSiteFingerprint()`, `privacyResumeSiteFingerprint()`	Fingerprint protection for a site.
`privacySetPaneFingerprint()`, `privacyPaneFingerprint()`	The same, for one pane.
`privacySetSiteLockdown()`, `privacySetPaneLockdown()`, `privacyPaneLockdown()`	Lockdown for a site or pane.
`privacySetSiteAdblock()`, `privacySetPaneAdblock()`, `privacyPaneAdblock()`	Ad blocking for a site or pane.
`privacyForgetSite()`	Clear a site’s data, permissions and overrides.
`privacyReloadPanes()`	Reload panes so a change takes effect.

// Turn fingerprint protection off for one site, then reload to apply
await kaba.core.privacySetSiteFingerprint('https://example.com', false);
await kaba.views.hardReload();

Passing null instead of true or false removes the override and returns to the global default.

Tor

torStatus(), torSetGlobal(), torSetPane(), torServiceOnion(), torPushAutoDomains().

Safe Browsing

securityIocStatus(), securityIocUpdate(), securitySetBlocking(), securityIocCheck(), securityIocCheckDownload().

Vault

Method	Purpose
`vaultStatus()`, `vaultLock()`	Locked or unlocked.
`vaultList()`, `vaultListAll()`, `vaultGet()`	Read entries.
`vaultSave()`, `vaultUpdate()`, `vaultDelete()`	Change entries.
`vaultTotp()`, `vaultDecodeTotpQr()`	Two-factor codes.
`vaultConfigGet()`, `vaultConfigSet()`	Backend settings.
`vaultRescan()`, `vaultRescanIfStale()`	Re-read an external store.

A passkey’s private key is never returned by these calls. The vault refuses to hand a passkey secret to any page, does not list passkeys for autofill, and does not allow editing one.

Certificates

kaba.certExceptions.getDetails(), accept() and revoke() manage exceptions for sites whose certificate failed. They are used by the certificate error page.

Writing a built-in page safely

Treat anything read from a web page, including through kaba.views.runInPane(), as untrusted input.
Do not embed web content in an iframe inside a kaba:// page and then act on messages from it.
Use kaba.core.widgetFetch() for cross-site requests from a widget, not ad-hoc script injection.
Never write secrets to localStorage; use the vault.