new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Deno · Fundamentals · all subjects

permissions

8 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

FFI requires --allow-ffi permission flag

Using Deno's Foreign Function Interface (FFI) to call native libraries requires running scripts with the --allow-ffi permission flag. For example: deno run --allow-ffi my_ffi_script.ts

Native code via FFI bypasses Deno security sandbox

Unlike JavaScript code running in the Deno sandbox, native libraries loaded via FFI have the same access level as the Deno process itself. This means they can access the filesystem, make network connections, access environment variables, and execute system commands. Always ensure you trust the native libraries you're loading through FFI.

npm permission system in Deno

npm packages run under the same permission system as rest of the code. If a package reads files or environment variables, grant -R (--allow-read) or -E (--allow-env), or answer permission prompts.

Permission audit logging to OpenTelemetry

To route the permission audit log into the OpenTelemetry exporter, set DENO_AUDIT_PERMISSIONS=otel (instead of a file path). Each permission access (allowed or denied) is emitted as an OpenTelemetry log record with attributes: deno.permission.type (permission name like 'read', 'net', 'env'), deno.permission.value (specific value being checked), and deno.permission.stack (JavaScript stack frames, only when DENO_TRACE_PERMISSIONS is also set).

Deno secure defaults reduce vulnerability risk

Deno has secure defaults that require explicit permission for file, network, and environment access, reducing the risk of security vulnerabilities.

Deno security model is sandbox by default

Code runs in a sandbox with no access to the network, filesystem, environment, or subprocesses until you explicitly grant it. A script that tries to read a file without permission stops and asks, or fails if prompts are disabled.

Grant permissions with --allow-* flags

Use `--allow-net` to grant network access, `--allow-read` to grant filesystem read access, and other `--allow-*` flags. These flags can be scoped down to specific resources. Short forms exist for each flag: `-N` for `--allow-net`, `-R` for `--allow-read`, `-E` for environment access. Multiple flags can be combined: `deno run -N=api.example.com -E main.ts`. Use `--deny-*` to carve out exceptions from broader permissions, or `-A` / `--allow-all` to skip the sandbox entirely.

Scoped permission example: --allow-read with directory

Permissions can be scoped to specific paths. For example, `deno run --allow-read=./data main.ts` grants read access only to the `./data` directory.

Give your agent this brain