Docs/Help & safety

Security model

These SDKs are embedded in third-party publisher apps and websites and render creatives that originate, in part, from external demand (OpenRTB DSPs). Every SDK is built to a treat-every-creative-as-hostile model.

Reporting a vulnerability

Email security@theaimart.co with details and a PoC if possible. Please do not open a public issue for undisclosed vulnerabilities. Acknowledgement target: 72 hours.

Trust boundaries

NameTypeRequiredNotes
api_key, slot_id, base_urlTrustedOptionalDeveloper-controlled. Used as-is; api_key is a public client id by design, not a secret.
page_url, keywords, consent stringsSemi-trustedOptionalPage/app-controlled. Byte-percent-encoded into the query (WAF-safe) — see encoding — never placed in headers.
client_ip, identity_cookieSpoofableOptionalOften derived from spoofable input. Control characters are stripped before use as header values.
Ad response (html, asset_url, click_url, imp_id)UntrustedOptionalMay come from an external DSP. See creative handling below.

Controls enforced in every SDK

1. Hostile creative → no code execution

  • HTML/OpenRTB creatives render only inside a sandboxed iframe (sandbox="allow-scripts allow-popups allow-popups-to-escape-sandbox", no allow-same-origin) or a locked-down native WebView. Markup is never injected into the host DOM / view tree.
  • No JavaScript bridge. Native WebViews add no addJavascriptInterface (Android) and no WKUserContentController message handlers (iOS) — the primary native-WebView RCE vector, intentionally absent. Android WebViews additionally disable file/content access (allowFileAccess=false, allowContentAccess=false, allow*FileURLs=false).
  • Because allow-same-origin is withheld, iframe scripts run in an opaque origin and cannot read the publisher page's cookies, storage, or DOM.
  • A click_url becomes a navigable link / is opened only when its scheme is http or https. A javascript:/data:/file:/intent: URL is dropped (the image still renders, without a link). Enforced in render_html (server SDKs) and every native click handler.
  • asset_url images are loaded only over http/https in native loaders (rejects file:///content:// local-resource loads).

3. Injection

  • Query / WAF: all free-text params are percent-encoded byte-by-byte, so no value can break out of the query or smuggle content — see WAF-safe encoding.
  • HTTP header injection: client_ip and identity_cookie have control characters (CR/LF/NUL) stripped before being set as X-Forwarded-For/Cookie, so a spoofed value cannot add headers.
  • HTML injection / XSS: server-side render_html HTML-escapes every interpolated value; creative markup is only ever placed in a sandboxed iframe srcdoc (escaped), never live-parsed into the page.

4. Transport

  • TLS certificate validation is never disabled in any SDK. No SDK sets InsecureSkipVerify, a permissive TrustManager/HostnameVerifier, allowsAnyHTTPSCertificate, or similar. Production traffic is HTTPS to api.adx.theaimart.co.
  • Fail-closed: any network error, timeout, non-200, or unparseable body yields a no-fill — the SDK never throws into the host app and never renders partial/garbage state. See Rate limits & errors.

5. Data minimization

  • SDKs send only what the ad request needs. They do not log request/response bodies, the identity cookie, or PII. api_key is public; there are no embedded secrets.
  • Server-side SDKs (Python/Node/Rust) that proxy many users must forward each user's own UA/IP and must not share one identity_cookie across users — see Requesting an ad.

Known accepted trade-offs

  • allow-popups-to-escape-sandbox is included so ad click-throughs can open the landing page in the top window — this matches industry-standard ad rendering. The main protection (no allow-same-origin, no JS bridge) is unaffected.
  • The Web SDK issues header-less "simple" cross-origin GETs with credentials: 'include'; it is therefore limited by the backend CORS allowlist and cannot exfiltrate cross-site.

Verification

Security-relevant behavior is covered by automated tests in every runnable SDK: hostile javascript: click URLs are dropped, header-injection is scrubbed, WAF-safe encoding is asserted, and fail-closed behavior is exercised end-to-end against a mock server reproducing the backend WAF. The native SDKs (Android/iOS/Flutter/Unity) carry the same controls in code and are verified with their platform toolchains — see each platform's Build & test section.