Security model
These SDKs are embedded in third-party publisher apps and websites and render creatives that originate, in part, from external demand (OpenRTB DSPs). Every SDK is built to a treat-every-creative-as-hostile model.
Reporting a vulnerability
Email security@theaimart.co with details and a PoC if possible. Please do not open a public issue for undisclosed vulnerabilities. Acknowledgement target: 72 hours.Trust boundaries
| Name | Type | Required | Notes |
|---|---|---|---|
api_key, slot_id, base_url | Trusted | Optional | Developer-controlled. Used as-is; api_key is a public client id by design, not a secret. |
page_url, keywords, consent strings | Semi-trusted | Optional | Page/app-controlled. Byte-percent-encoded into the query (WAF-safe) — see encoding — never placed in headers. |
client_ip, identity_cookie | Spoofable | Optional | Often derived from spoofable input. Control characters are stripped before use as header values. |
Ad response (html, asset_url, click_url, imp_id) | Untrusted | Optional | May come from an external DSP. See creative handling below. |
Controls enforced in every SDK
1. Hostile creative → no code execution
- HTML/OpenRTB creatives render only inside a sandboxed iframe (
sandbox="allow-scripts allow-popups allow-popups-to-escape-sandbox", noallow-same-origin) or a locked-down native WebView. Markup is never injected into the host DOM / view tree. - No JavaScript bridge. Native WebViews add no
addJavascriptInterface(Android) and noWKUserContentControllermessage handlers (iOS) — the primary native-WebView RCE vector, intentionally absent. Android WebViews additionally disable file/content access (allowFileAccess=false,allowContentAccess=false,allow*FileURLs=false). - Because
allow-same-originis withheld, iframe scripts run in an opaque origin and cannot read the publisher page's cookies, storage, or DOM.
2. Navigation / URL safety
- A
click_urlbecomes a navigable link / is opened only when its scheme ishttporhttps. Ajavascript:/data:/file:/intent:URL is dropped (the image still renders, without a link). Enforced inrender_html(server SDKs) and every native click handler. asset_urlimages are loaded only overhttp/httpsin native loaders (rejectsfile:///content://local-resource loads).
3. Injection
- Query / WAF: all free-text params are percent-encoded byte-by-byte, so no value can break out of the query or smuggle content — see WAF-safe encoding.
- HTTP header injection:
client_ipandidentity_cookiehave control characters (CR/LF/NUL) stripped before being set asX-Forwarded-For/Cookie, so a spoofed value cannot add headers. - HTML injection / XSS: server-side
render_htmlHTML-escapes every interpolated value; creative markup is only ever placed in a sandboxed iframesrcdoc(escaped), never live-parsed into the page.
4. Transport
- TLS certificate validation is never disabled in any SDK. No SDK sets
InsecureSkipVerify, a permissiveTrustManager/HostnameVerifier,allowsAnyHTTPSCertificate, or similar. Production traffic is HTTPS toapi.adx.theaimart.co. - Fail-closed: any network error, timeout, non-200, or unparseable body yields a no-fill — the SDK never throws into the host app and never renders partial/garbage state. See Rate limits & errors.
5. Data minimization
- SDKs send only what the ad request needs. They do not log request/response bodies, the identity cookie, or PII.
api_keyis public; there are no embedded secrets. - Server-side SDKs (Python/Node/Rust) that proxy many users must forward each user's own UA/IP and must not share one
identity_cookieacross users — see Requesting an ad.
Known accepted trade-offs
allow-popups-to-escape-sandboxis included so ad click-throughs can open the landing page in the top window — this matches industry-standard ad rendering. The main protection (noallow-same-origin, no JS bridge) is unaffected.- The Web SDK issues header-less "simple" cross-origin GETs with
credentials: 'include'; it is therefore limited by the backend CORS allowlist and cannot exfiltrate cross-site.
Verification
Security-relevant behavior is covered by automated tests in every runnable SDK: hostile javascript: click URLs are dropped, header-injection is scrubbed, WAF-safe encoding is asserted, and fail-closed behavior is exercised end-to-end against a mock server reproducing the backend WAF. The native SDKs (Android/iOS/Flutter/Unity) carry the same controls in code and are verified with their platform toolchains — see each platform's Build & test section.