docs: add guideline about fetching remote code (#201)

MetaMask · Nov 16, 2023 · 06ee7ad · 06ee7ad
1 parent fcd8b42
commit 06ee7ad
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/docs/security.md b/docs/security.md
@@ -214,5 +214,11 @@ export const onKeyringRequest: OnKeyringRequestHandler = async ({
 };
 ```
 
+### Don't fetch remote code from inside your Snap
+
+Your Snap should be self-contained and not fetch code from external sources.
+Otherwise a compromised server could use this mechanism to inject malicious
+code into your Snap.
+
 [eth-phishing-detect]: https://github.com/MetaMask/eth-phishing-detect
 [async-flow]: ./architecture.md#asynchronous-transaction-flow