Security Overview
Security controls, host responsibilities, and limits of verification.
forceCalendar provides defensive controls, but deployment security depends on the host, data and integrations. Test results and an npm audit snapshot are not a comprehensive security certification.
Package and host boundaries
Core has no runtime package dependencies. That reduces transitive dependency exposure; it does not remove vulnerabilities in Core, build tooling, frameworks or applications. Keep lockfiles and runtime dependencies reviewed across the entire deployed stack.
Calendar computation is headless. Some optional helpers access the browser, Workers or network. ICSHandler.importFromURL() and subscriptions perform outbound requests; it is incorrect to describe every Core API as network-free.
The Interface renders event text through DOM/text APIs and sanitizes color values. It also uses Shadow DOM styles and inline style properties. Validate script-src, style-src, connect-src and worker-src against the actual host policy instead of assuming that avoiding eval() guarantees strict-CSP support.
Important controls
| Boundary | Control | Host responsibility |
|---|---|---|
| Event data | Required-field/date checks and field limits | Schema, payload size, permissions and business rules |
| ICS input | Size, line and event limits | Smaller workload limits and trust decisions |
| ICS URL fetch | URL/IP checks; Node DNS and redirect validation | Egress restrictions, allowlisting and DNS-rebinding protection |
| Recurrence | Occurrence/iteration bounds | Bounded windows, workload testing and correctness checks |
| DOM output | Text nodes and color sanitization | Never turn event content into executable HTML/CSS |
| UI editing | readOnly interaction option | Server-side authorization for every write |
| Salesforce | User-mode queries/DML and sharing | Intended-user permissions and org verification |
| Application tools | Public headless calendar APIs | Host authentication, authorization, persistence, concurrency and audit controls |
See security model for URL-fetch limits, and hardening status for the difference between controls and assurance. Report suspected vulnerabilities through the organization security policy.