Scripting Security

​

FAQs

​

How Rive approaches script security

• The sandbox is the safety boundary. Rive does not depend on trusting the person who made a file. Code in a file runs inside a sandbox that limits what it can reach, so even a harmful script cannot reach anything Rive doesn’t allow.
• Scripts start with nothing. Rive adds each ability on purpose, as an API it controls: drawing, View Models, input, audio, and the objects in the script’s own file. A script cannot use anything Rive did not give it.
• Signing proves where code came from, not that it is safe. Rive requires a signature only where the engine cannot check code itself: Luau bytecode and compiled shaders. Rive compiles that code on its own servers, so it signs only code it produced. AnimaScript needs no signature, because the WebAssembly sandbox checks and contains every module.
• A script that breaks the rules stops with an error. Your app keeps running. Time limits stop most script calls that run too long, but not all of them, and a script can still use enough CPU, GPU, or memory to slow or freeze your app. See Time limits for what each limit covers.
• Your app decides. A file cannot act on your app directly. It can only hand values to your code, and your code decides what to do with them.

​

What code in a file can do

• Draw inside its view. It cannot draw outside the view or change the rest of your app’s UI.
• Play sounds stored in the file. AnimaScript scripts can also generate sound.
• React to the input that reaches its view: pointer, keyboard, gamepad, and text entry.
• Read and change the View Model data your app binds to it.
• Report events to your app.

• Make network requests. The one exception, downloading Hosted assets, is done by the runtime, and your app controls it. See Hosted assets.
• Read or write files on the device.
• Read device data such as location, contacts, photos, camera, microphone, or clipboard.
• Read app data that you have not bound to the file.
• Reach other Rive files your app has loaded. Each file runs its scripts in its own environment.
• Load code from outside the file, or create new code while it runs.
• Navigate your app.
• Open URLs, unless you turn it on. Only the web runtime can do this, using the deprecated automaticallyHandleEvents option. See Open URL events.

​

How each language is contained

​

AnimaScript

• On the web, the runtime loads the module into the browser’s own WebAssembly engine, the same sandbox that browsers use for all WebAssembly.
• Outside the browser, Rive runs modules with WAMR, an open-source WebAssembly runtime, under the same sandbox rules. A .riv file carries these modules only as WebAssembly bytecode, never as machine code, and the runtime rejects anything else. Depending on the platform, a module runs as machine code compiled ahead of time, or on WAMR’s interpreter. The Apple and Android runtimes do not run AnimaScript yet. See Where Scripts Run.

• A module can call only the functions Rive provides. It has no other way to reach the system.
• Every memory access stays inside the module’s own memory. An access outside it, or a bad pointer passed to a Rive API, stops the module with an error.
• Threads and audio processors run in sandboxed modules of their own. Any memory they share belongs to the same file’s scripts.

​

Luau

• Base functions, without loadstring
• table, math, string, utf8, buffer, and bit32
• os, limited to clock, date, difftime, and time

​

Shaders

​

Time limits

• AnimaScript: every call into a script runs under a time budget, 200 ms in the runtimes. Native runtimes enforce it with a timer. In browsers, a call can be stopped only if the module was built with fuel checks. Debug builds always include them. Optimized builds, which every publish makes, include them only with wasmFuel: true. Without fuel checks, a script that never returns hangs the page. Builds made with dangerouslyFast have no time budget at all. Background jobs and workers have no time limit; they run until they finish or the runtime stops them. See Build Settings.
• Luau: Rive runtimes interrupt a Luau script call that runs longer than 200 ms. A script written to get around the interrupt can keep running.

​

What signing guarantees

​

What a signature does not prove

• Who made the file, or that its scripts are yours. Today, Rive signs every export with the same key, whatever the account or Workspace. Anyone can write Luau scripts in their own Rive account and export them with a valid signature, so a swapped file with someone else’s scripts passes the check. The sandbox limits what those scripts can do. The signature does not.
• That the rest of the file is unchanged. Today the signature covers only compiled Luau scripts and shaders.

​

What the signature covers

• Artboards, Timelines, and State Machines
• Text, images, fonts, and audio
• Default View Model values and script input values
• Event settings, such as the address of an Open URL event
• Which objects use which scripts
• AnimaScript modules

​

Whole-file signing

​

Protecting files between design and release

​

Files bundled in your app

• Keep approved .riv files in version control, and change them only through code review.
• Record the SHA-256 hash of each approved file, and check it in your build pipeline.

​

Files your app downloads

import CryptoKit
import Foundation

enum RiveFileError: Error { case integrityCheckFailed }

// SHA-256 of the approved file, as lowercase hex, built into the app.
let expectedHash = "<sha-256 of the approved file>"

// fileURL points to the downloaded file on disk.
func verifiedRiveData(from fileURL: URL) throws -> Data {
    let data = try Data(contentsOf: fileURL)
    let hash = SHA256.hash(data: data)
        .map { String(format: "%02x", $0) }
        .joined()
    guard hash == expectedHash else { throw RiveFileError.integrityCheckFailed }
    return data // Pass these bytes to the Rive runtime.
}

import java.io.File
import java.security.MessageDigest

// SHA-256 of the approved file, as lowercase hex, built into the app.
const val EXPECTED_HASH = "<sha-256 of the approved file>"

// file is the downloaded file on disk.
fun verifiedRiveBytes(file: File): ByteArray {
    val bytes = file.readBytes()
    val hash = MessageDigest.getInstance("SHA-256").digest(bytes)
        .joinToString("") { "%02x".format(it) }
    check(hash == EXPECTED_HASH) { "Rive file failed its integrity check" }
    return bytes // Pass these bytes to the Rive runtime.
}

​

Network requests, URLs, and navigation

​

Scripts

​

Hosted assets

​

Open URL events

​

Navigation

​

Turning off scripting

​

Recommendations for apps that handle sensitive data

1. Control where files come from. Bundle files in your app when you can, and check every downloaded file before you load it.
2. Bind only the data a file needs. Scripts can read every View Model property your app binds to their file. Never put passwords, tokens, or full card numbers in a View Model.
3. Use native text fields for secrets. Scripts can read what users type into a Text Input in their file.
4. Keep secrets out of files. A .riv file is not encrypted. Anyone who has the file can inspect its contents, including compiled scripts and any text in them.
5. Treat what a file sends back as untrusted input. Check events and View Model values before you act on them. For URLs and screens, accept only values from a list you define.
6. Turn off what you don’t use. If you don’t use Hosted assets, turn off their download. Leave automaticallyHandleEvents off on the web. If your files have no scripts, use a runtime without scripting.
7. Ask for fuel checks on the web. If your web app plays AnimaScript files from outside your team, ask for files built with wasmFuel: true, so the browser can stop a runaway script. Don’t ship files built with dangerouslyFast unless you trust their source.
8. Keep your Rive runtime up to date to get security fixes.

​

Security resources

• Open-source runtimes. The Rive runtimes are open source under the MIT license, so your team can review the code your app runs: rive-runtime (the C++ core, including the signature check and both scripting engines), rive-ios, rive-android, and rive-wasm.
• AnimaScript. Where Scripts Run explains how AnimaScript runs on each platform and how its time budgets work.
• SOC 2 Type II. Part of the Enterprise plan.
• Reporting a vulnerability. Contact us privately through the support form. Please don’t report security issues in the community forum or in GitHub issues.