Machine Code/Rust/WASM, SVG/Native, Server/Client

1. Four words that get confused

Base64 and machine code both look unreadable. Neither is secret.

2. SVG is a document that can run code

An SVG is XML. Besides shapes, it can hold <script>, onload= handlers, <foreignObject> with embedded HTML, links to outside files, and text and metadata that carry names and IDs. Base64-encoding it into a data: URI keeps every one of those, about 33% larger, and hides <script from any filter that only reads text.

How the page displays it decides whether that code runs:

Treat untrusted SVG as code: decode it, sanitize it (DOMPurify or svgo, removing script, on* handlers, foreignObject and outside links), display it with <img>, and serve uploads from a separate asset domain with Content-Security-Policy: sandbox. Treat an exported chart as the data it shows: an SVG of patient results is PHI.

Native code has the opposite problem. A parser written in C that reads an untrusted image or 3D file can be exploited through a memory bug. That is why this site's GLB parser is a no_std Rust crate with no unsafe code (firmware/glb-parse).

3. Rust and Elm turn rules into compile errors

Rust's ownership rules mean every value has one owner, and passing it moves it. That makes a consent check something the compiler enforces:

pub fn send_to_ads(data: Pii<Email>, grant: ConsentGrant) -> Result<(), Error> { /* … */ }

let grant = consent::verify(&req)?;   // the only way to get one
send_to_ads(email, grant)?;
send_to_ads(other_email, grant)?;     // compile error: use of moved value `grant`

• Single use: a ConsentGrant is consumed by the send, so one consent can't cover two exports.
• No accidental logging: a Pii<T> wrapper whose Debug prints [REDACTED] and that doesn't implement Serialize can't end up in a log line or a JSON response.
• Read versus write: a function that takes &PatientRecord can't change it; only &mut can, and only one at a time.

Elm gets similar guarantees differently. Functions are pure, so a view that renders patient data can't send it anywhere. Opaque types decide in one module what any screen may show. Ports are the only exit to JavaScript, which gives you one list to audit, and Elm packages can't contain JavaScript.

Both guarantees hold inside one program. Types force a check to happen; they can't prove the check is the right one.

4. WebAssembly limits reach, not readership

A Wasm module gets its own linear memory and can only call the functions its host gives it. Shopify Functions take this further: Rust compiled to Wasm, a GraphQL query in, a list of operations out, no network, no files and an instruction limit. A Cloudflare Worker runs in its own V8 isolate and reaches the network only through fetch.

That makes Wasm a strong place to run rules. It doesn't make data private: whatever the module is handed, it can read, and the sandbox is only as tight as the host imports (WebAssembly security).

5. Server versus client

The browser is untrusted. Anyone can edit the compiled JavaScript or call your API directly, so a rule enforced only in client code, in Elm or React, protects your users from your bugs, not your server from attackers.

CORS is a browser rule, not access control. The only layer that stops an unauthorized caller is server-side authorization that checks each record.

Next.js blurs the line. Server Components fetch data on the first request, before a consent banner has loaded. The props they return are serialized into the HTML and the RSC payload, where they outlive TLS in View Source, saved pages and caches. Any variable prefixed NEXT_PUBLIC_ is compiled into the client bundle.

6. TLS is hop by hop

Each arrow in a pipeline is its own TLS session, and the data is plaintext inside every box. Anything stored, cached, logged or rendered there is outside TLS's protection.

Next.js server render to client hydration: browser request → CDN edge (TLS ends; HTML may be cached) → Next server (fetches on request) → Shopify or Xano API (server-to-server call, request logs) → browser hydration (props readable in the page).

CRM to Shopify cloud data bus: CRM in Xano → queue or webhook table (payload stored at rest) → Cloudflare Worker (Admin token from KV) → Shopify Admin API → Shopify webhook back (verify the HMAC on the raw body).

For a data bus, sign each message (HMAC or Ed25519), encrypt sensitive fields end to end, and use mTLS between services, so a decrypting hop can't read or alter what it forwards.

7. Three stacks for the same data

The same products, customers, consent and conversions can move through very different runtimes.

The JVM no longer has an in-process sandbox: the Security Manager was deprecated in Java 17 (JEP 411), so every dependency runs with the application's full rights. SAP itself can run on AWS, Azure or Google Cloud, so a stack like this one may cross clouds, adding a TLS hop and a data-residency question at each crossing.

Consent Mode v2 and idempotency are data rules, not runtime features. Every stack has to carry the consent state (ad_user_data, ad_personalization and the storage signals) and a stable idempotency key with every event, or retries create duplicates and audiences reach Google without consent.

8. VM, Docker and Kubernetes

A VM is the stronger wall and a container is the faster one. Neither encrypts data on the wire. Lock down pod traffic with a default-deny NetworkPolicy and encrypt it with mTLS or WireGuard. Use confidential VMs (AMD SEV-SNP, Intel TDX) where PHI or card data must stay hidden even from the cloud host.

9. 31 gaps and the control that closes each

Base64 changes how data is written, not who can read it. Compiling changes what code can do. TLS protects the wire, not the endpoints, and sandboxes limit reach, not readership. Only encryption, server-side authorization and contracts decide who can read the data.

Sources

• MDN: SVG <script> element
• OWASP: Cross-Site Scripting Prevention Cheat Sheet
• The Rust Book: What is ownership?
• Elm Guide: Ports
• WebAssembly: Security
• Shopify: Functions
• Cloudflare: Full (strict) SSL mode
• Next.js: Environment variables
• Google: Consent mode
• OpenJDK: JEP 411, deprecate the Security Manager
• Microsoft: Service Bus duplicate detection
• Kubernetes: Secrets, encrypting data at rest, network policies
• Docker: Build secrets