Product Architecture & Boundaries
Why BOSS?
The browser environment has evolved into a full application OS. BOSS provides structured security oversight where conventional server controls cannot reach.
Security Architecture Comparison
Traditional Security Stack
Browser Execution (Unmonitored)
↓
Application Layer
↓
Web Application Firewall (WAF)
↓
Backend Infrastructure
Client-side scripts, service worker hijacking, and response header anomalies remain invisible to backend WAFs.
BOSS Architecture
Browser Execution
↓
BOSS Service Worker (boss-sw.js)
↓
Structured Security Telemetry
↓
Rust + Rocket Backend Dashboard
Adds immediate visibility into fetch calls, redirects, header tampering, and cache anomalies at the browser layer.
"Observe first. Decide with evidence."
BOSS focuses on observing browser-visible signals and producing structured, high-confidence security findings rather than blindly breaking or blocking web application functionality without proof.
What BOSS Cannot See
Explicit security boundaries enforced by native browser engines. BOSS respects web sandboxing rules.
Arbitrary page DOM
Service workers do not have direct access to DOM trees of host pages.
localStorage directly from SW
Service Worker global scope lacks access to window.localStorage.
sessionStorage
SessionStorage is tied strictly to individual window tab contexts.
Browser saved passwords
Protected by native browser credential store security bounds.
Operating system activity
Service worker execution is strictly sandboxed inside browser engine.
Browser internal processes
Process memory, V8 engine internals are inaccessible to script context.
Cross-origin data
Same-Origin Policy enforces strict isolation between different domains.