WebGPU security and robustness model

Document status: reviewed. Canonical source.

Summary

WebGPU explicitly treats malicious use, uninitialized/out-of-bounds data, driver bugs, timing channels and GPU robustness as first-class concerns. Validation and zero-initialization guarantees are central to safe exposure of GPU resources.

NUIF relevance

The reference renderer must assume documents are hostile, enforce allocation/complexity budgets before issuing GPU work, validate shader/effect extensions and preserve a sandbox boundary around any programmable rendering extension.