João Henrique
b541f502ba
- Adicionado estrutura completa do projeto - Configurado MCP server para Premiere Pro - Adicionado documentação e skills - Configurado Gitignore para o projeto
1.0 KiB
Executable File
1.0 KiB
Executable File
Recommendation 33: generated UXP permission minimization
Evidence
Adobe UXP manifests explicitly declare network and local-file-system permissions. Permission scope is part of the install-time trust boundary.
Proposed improvement
Generate release manifests from a reviewed permission policy and fail CI on undeclared expansion. Separate development, benchmark, and production permissions; include a human-readable permission diff in releases.
Acceptance criteria
- Production never inherits development-only addon or network permissions.
- New permissions require rationale, threat analysis, and explicit review.
- Runtime endpoints are still validated even when Adobe requires a broad domain declaration.
- Packaged manifest hashes are verified in release provenance.
Manifest minimization reduces exposure but does not replace runtime authentication.