--- title: "A Compromised Server Can't Inject Code" date: 2026-05-28 type: post tags: [bundler, security, signing, cloudpack, threat-model] summary: "The manifest server tells browsers which chunks to fetch. If an attacker owns it, they can redirect to existing content-hashed chunks. They can't inject new code. The signature covers the chunk hashes, not the advisory fields." --- Suppose an attacker compromises the manifest server. They have full control: they can rewrite every response, change every URL, serve whatever JSON they want. What can they do? They can tell browsers to fetch different content-hashed chunks from the CDN. Chunks that already exist. Chunks that were produced by legitimate builds. What can't they do? They can't inject new JavaScript. They can't create a chunk that doesn't already exist on the CDN. They can't modify a chunk's contents without invalidating its content hash. And they can't forge the ed25519 signature that covers those hashes. This is the security property that the entire Adaptive Bundle Service is designed around. The manifest server is not trusted with code. It is trusted with *routing*. And routing to existing, signed, content-hashed artifacts is a smaller attack surface than serving arbitrary content. ## The industry default Most web applications rely on two mechanisms for delivery integrity: HTTPS between CDN and browser, and Subresource Integrity (SRI) attributes in HTML. HTTPS prevents a network attacker from modifying content in transit. It does nothing if the server itself is compromised. SRI hashes are embedded in `