Permissions and the security model

Scripts are treated as untrusted code, whether you wrote them, imported them, or received them from someone else.

Permissions

A script lists the permissions it wants in its header. You approve them in the Script Manager.

Name	Allows
send	Sending messages, notices and actions
channels	Joining and leaving channels
notify	Showing notifications, labelled with the script’s name
storage	Keeping data between runs
aliases	Running your own native aliases with swizzin.alias

Logging, reading events, timers, commands and swizzin.networks() need no permission.

Approvals are stored per script in scripts.json. They are:

• Inspectable: the Script Manager lists what a script asks for and what is approved.
• Revocable: Revoke removes every approval and stops the script.
• Renewed when privileges grow: if a script asks for more than was approved, it stays stopped as Needs approval until you approve again.

New, imported and example scripts are always off and unapproved.

What a script can never do

Not by default, and not with any permission:

• Read or write files, list folders, or load other scripts.
• Run programs or system commands, open sockets, or make network requests of its own.
• Read saved passwords, SASL secrets, ZNC passwords, tokens or the Windows credential store.
• See another script’s state or saved data.
• Send raw IRC protocol lines.
• Send text that looks like an authentication command to a services bot, or message ZNC *module pseudo-users such as *status or *controlpanel.

Resource limits

Resource	Limit
Memory	16 MB per script
CPU in one callback	250 ms
Loading a script	1 s
Messages sent	10 per second, burst of 20
Pending events	256 per script
Registrations	64 handlers, 32 commands, 32 timers
Failing callbacks	10 in a row, then the script is stopped
Console output	50 lines per callback, 1000 lines kept

Every script runs on its own thread with its own Luau state.

What is not guaranteed

• A thread blocked outside Luau cannot be interrupted. A watchdog abandons a script thread that has been busy for 4 seconds, marks the script Stopped (unresponsive) and silences anything it later tries to do. The abandoned thread remains until the application exits.
• A script can measure time and observe the events it is allowed to see.
• A script with send can send any text you could send, except the refused authentication-like text. The rate limit bounds the damage; it does not decide what is appropriate.
• Scripts run inside the application process, not in a separate process.

Reporting security issues

Contact Swizards LLC through https://swizards.net.