test: add sensitive-content boundary tests for Utix surfaces

[Wiseman52]

Overview

This PR adds sensitive-content boundary tests across Utix rendering, downloads, webhooks, and exports, and hardens the CodeBlock renderer so untrusted content cannot execute, escape sandboxing, leak private fields, or bypass allow-lists. It also documents operational edge cases, failure modes, and rollback/recovery steps for these boundaries.

Related Issue

Changes

🛡️ Sensitive-Content Boundary Tests

• [MODIFY] core/sandbox/__tests__/sandbox.test.ts

  • Adds boundary cases proving untrusted rendered content cannot execute scripts, escape the sandbox, or reach disallowed origins.
  • Covers allow-list enforcement for sandboxed content and download-triggered payloads.

• [MODIFY] core/webhooks/__tests__/verification.test.ts

  • Adds boundary cases for webhook payload verification: rejects tampered/unsigned payloads, enforces allow-listed endpoints, and ensures private fields are not echoed back in verification responses.

• [MODIFY] core/security/__tests__/threat-model.test.ts

  • Adds threat-model assertions tying the above boundaries to the documented sensitive-content threat surface (execution, sandbox escape, private-field leakage, allow-list bypass).

• [MODIFY] core/ui/CodeBlock.tsx

  • Hardens rendering of untrusted code content: escapes content, avoids unsafe HTML injection, and preserves existing public props/behavior for trusted callers.

• [MODIFY] docs/EXPORTS.md

  • Documents export boundary behavior, operational edge cases, failure modes, and rollback/recovery steps for sensitive-content exports.

Verification Results

npm test -- core/sandbox/__tests__/sandbox.test.ts
npm test -- core/webhooks/__tests__/verification.test.ts
npm test -- core/security/__tests__/threat-model.test.ts
✅ Boundary suites pass (execution, sandbox escape, private-field leakage, allow-list bypass covered)

Acceptance Criteria	Status
Untrusted content cannot execute	✅ Covered by sandbox + CodeBlock boundary tests
Untrusted content cannot escape sandboxing	✅ Covered by sandbox boundary tests
Private fields cannot leak	✅ Covered by webhook verification + threat-model tests
Allow-lists cannot be bypassed	✅ Covered by sandbox + webhook verification tests
Automated tests / executable verification included	✅ Added to existing test suites
Edge cases, failure modes, rollback/recovery documented	✅ Documented in docs/EXPORTS.md
Compatible with existing public APIs/schemas	✅ CodeBlock public props unchanged; no schema changes

Closes #233

[drips-wave]

@Wiseman52 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits