Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Security model

Safe mode and insecure mode have different trust assumptions.

Safe mode

Safe mode is designed for host-provided APIs that exchange copied values, opaque handles, and bounded resources. It does not expose raw native addresses.

Package isolation prevents ordinary JavaScript objects and globals from being shared across runtimes. It does not turn an injected module into an operating-system security boundary.

Insecure mode

Insecure mode trusts the complete package, including every relative module it imports. FFI can:

  • Read or overwrite process memory
  • Load DLLs
  • Invoke exported native functions
  • Block the game thread
  • Bypass future safe host-API validation
  • Crash the process despite exception containment

The global toggle is persisted in Fumoware configs. Loading a config without the setting returns the engine to safe mode, preventing insecure state from leaking between configs.

Do not enable insecure mode for downloaded or obfuscated packages.