Stream: git-wasmtime

Topic: wasmtime / PR #14155 docs: add security warning to 'wasmt...

Wasmtime GitHub notifications bot (Aug 19 2026 at 07:46):

Rohan170603 opened PR #14155 from Rohan170603:docs/serve-security-warning to bytecodealliance:main:

This PR addresses #14118 by adding dedicated documentation for the wasmtime serve command with an explicit security warning.

Problem

wasmtime serve lacks safeguards against:

• Unbounded outbound HTTP requests
• Rate limiting or connection throttling
• DDoS protections
• Request size limits
• TLS/HTTPS termination

It is intended only for development and testing purposes, yet the documentation provided no guidance or disclaimer about its limitations, potentially leading to accidental production deployment.

Solution

Added a new section in docs/cli.md:

• Description of wasmtime serve usage with example
• Clear security warning in callout format
• Explicit list of missing security features
• Recommendation to use a reverse proxy for production
• Pointer to --help for additional options

Related Issue

Closes #14118

Testing

• [x] Documentation renders correctly with mdBook
• [x] Links are functional
• [x] Formatting is consistent with existing docs

Wasmtime GitHub notifications bot (Aug 19 2026 at 07:46):

Rohan170603 requested fitzgen for a review on PR #14155.

Wasmtime GitHub notifications bot (Aug 19 2026 at 07:46):

Rohan170603 requested wasmtime-default-reviewers for a review on PR #14155.

Wasmtime GitHub notifications bot (Aug 19 2026 at 10:50):

github-actions[bot] added the label wasmtime:docs on PR #14155.

Wasmtime GitHub notifications bot (Aug 19 2026 at 15:16):

alexcrichton commented on PR #14155:

Thanks for the PR, but can this move to cli-options.md where the other subcommands are documented? Also please do not copy/paste the output of an LLM here without reviewing it yourself. You can read more about our AI tool usage policy here

Wasmtime GitHub notifications bot (Aug 19 2026 at 15:16):

alexcrichton unassigned fitzgen from PR #14155 docs: add security warning to 'wasmtime serve' command.

Wasmtime GitHub notifications bot (Aug 19 2026 at 15:16):

alexcrichton requested alexcrichton for a review on PR #14155.

Wasmtime GitHub notifications bot (Aug 20 2026 at 07:29):

Rohan170603 commented on PR #14155:

@alexcrichton Thanks for the review!

I apologize — I should have placed this in cli-options.md from the start. I'll move it there right away.

Regarding the AI policy — the content was written based on the issue description and my understanding of the feature. I did review it before submitting, but I understand the concern. I'll be more mindful going forward.

I'll update the PR with the content moved to cli-options.md.

Wasmtime GitHub notifications bot (Aug 20 2026 at 07:41):

Rohan170603 updated PR #14155.

Wasmtime GitHub notifications bot (Aug 20 2026 at 07:53):

Rohan170603 updated PR #14155.

Wasmtime GitHub notifications bot (Aug 20 2026 at 14:21):

:thumbs_up: alexcrichton submitted PR review.

Wasmtime GitHub notifications bot (Aug 20 2026 at 14:21):

alexcrichton added PR #14155 docs: add security warning to 'wasmtime serve' command to the merge queue.

Wasmtime GitHub notifications bot (Aug 20 2026 at 14:46):

:check: alexcrichton merged PR #14155.

Wasmtime GitHub notifications bot (Aug 20 2026 at 14:46):

alexcrichton removed PR #14155 docs: add security warning to 'wasmtime serve' command from the merge queue.

Last updated: Aug 30 2026 at 09:07 UTC